Blast radius

Blast radius answers one question: if this agent is wrong or compromised, how bad is it?

It is not a probability. Gate does not predict whether your agent will make a mistake. It describes consequence, which is knowable from configuration.

The levels

Name
LOW
Type
0-19
Description
Reads within a bounded scope. A mistake is recoverable and contained.
Name
MODERATE
Type
20-44
Description
Can modify state, but within a scope you chose and can restore.
Name
HIGH
Type
45-69
Description
Can reach beyond its workspace, destroy things, or act with meaningful privilege. A bad day.
Name
CRITICAL
Type
70-100
Description
Can execute arbitrary code, move money, reach credential stores, or act on production. An incident with customers in it.

Four bands, because more precision than that would be false precision.

What goes into it

Ten factors, each a named contributor that appears in the output:

Contributor	What it measures
`systems`	How many distinct servers the agent can reach
`tools`	How large the tool surface is
`capabilities`	Which capability classes are present
`credentials`	The privilege of the credentials in scope
`filesystem`	How far filesystem grants extend past the repository
`environment`	Whether anything looks like production
`reversibility`	Whether available actions can be undone
`execution`	Whether the agent can run arbitrary code
`egress`	Whether the agent can send data outside the system
`consequential-actions`	Whether it can spend money or destroy state
`combinations`	Dangerous capability pairs

Some facts are counted by more than one contributor. execute raises the capability mix and triggers the execution contributor. Each of the ten factors has to stand on its own in the output, so they overlap. The total is clamped to 100, so overlap changes ordering, not the ceiling.

The score

The score is not a measurement. There is no ground truth to calibrate against. It does two things:

orders a level, and
lets the same repository be compared against itself over time.

Gate always prints the contributors, so you can take a score apart instead of trusting it.

gate scan --json | jq '.blastRadius.contributors'

[
  {
    "id": "execution",
    "label": "arbitrary code or command execution",
    "points": 15,
    "detail": "Execution collapses every other boundary: an agent that can run commands can do anything the process can do."
  },
  {
    "id": "capabilities",
    "label": "capability mix: delete, execute, read, write",
    "points": 18,
    "detail": "The classes of action available to the agent."
  }
]

Escalation floors

Arithmetic is a bad way to express "this one fact is decisive". Some combinations are categorically severe regardless of how small the rest of the configuration is, so they override the score:

When	Floor
`execute` is present at all	at least `HIGH`
`execute` + a production-looking credential	`CRITICAL`
A credential directory (`~/.ssh`, `~/.aws`, `~/.kube`, home, root) + `communicate`	`CRITICAL`
`secrets` + `communicate`	at least `HIGH`
`financial` is present	at least `HIGH`
`delete` on a production-looking system	at least `HIGH`
Filesystem scope reaches home or root	at least `HIGH`

When a floor applies, the output names it:

Blast radius: CRITICAL (61/100)

Escalated because a credential directory is in scope alongside an external
communication channel.

The third row is the lethal trifecta in its most concrete form: the agent can read the directory where your keys live, and it can send things somewhere.

Reading the output

Blast radius: CRITICAL (84/100)

Why:
  + arbitrary SQL execution
  + production-looking credential in scope
  + destructive operations available
  + filesystem access beyond the repository

Each + line is something you can go and remove. Removing the top one usually moves the level, because the contributors are ordered by how much they mattered.

Comparing over time

The score's real job is the diff. With a baseline, Gate can say the only sentence that reliably changes behaviour in a code review:

This change increases the agent's blast radius.

NEW capabilities: execute, delete

A repository that has always had a shell tool does not need to fail every build. A repository that just gained one has made a new decision, usually inside a diff about something else.

Capabilities The thinking behind the model