The blast radius of an AI agent is the total scope of damage a compromised or misdirected agent can cause: the data it can read, the systems it can alter, the actions it can take, and the credentials it can expose. The question is no longer academic, and a growing set of tools now answers it. The answers differ in a way that matters architecturally.
How blast radius is measured today
Many published treatments emphasize identity and entitlement exposure. Approaches used by tools such as Obsidian Security map an agent's real authority across delegated entitlements, OAuth grants, and inherited credentials, surfacing the gap between what an agent's configuration declares and what it can actually do. Assessment tools such as Keeper Security's blast radius calculator score exposure across dimensions including attack surface, credential risk, governance posture, and detection gap. This work is valuable: entitlement sprawl and orphaned grants are real exposure, and mapping them is overdue in most environments.
It is also incomplete, and the gap presents challenges the identity plane cannot resolve from inside itself. Permissions are policy statements, and every permission check is an evaluation that has to happen correctly, in the right order, against the right identity, under conditions an attacker controls. Permission systems fail through misconfiguration, credential theft, and delegation chains nobody mapped. Measuring blast radius through entitlements alone measures exposure inside the very plane whose failure you are planning for.
The second measure
Reachability is a different kind of boundary: a resource that is not network-reachable from the agent's environment is absent from the set of things a permission check could ever be evaluated against.
| Permission scope | Effective reachability | |
|---|---|---|
| What it bounds | What the agent is authorized to do | What the agent can contact at all |
| Where it is evaluated | Per request, in the identity and application plane | Provisioned in advance and enforced independently at the endpoint or network layer |
| How it fails | Misconfiguration, stolen credentials, delegation abuse | Control-plane misconfiguration, unmapped intermediaries |
| What failure yields | Everything the stolen authority can claim | Identity failure alone adds no route; reachability changes only if its own control plane or an intermediary path fails |
| Fails with | The identity layer | Independently of the identity layer |
Neither replaces the other. Reachability is provisioned by a control plane, and control planes can be misconfigured; a reusable credential exfiltrated to attacker infrastructure still works wherever that infrastructure has access, which is why credential controls exist as their own practice. The security comes from enforcing the two independently, so a failure in identity or permission does not hand the attacker a network path. When permission fails, the blast radius it bounds expands with the stolen authority; blast radius bounded by reachability does not inherit that failure.
Project-scoped isolation
The unit of scoping is the project. Everything the project's agents legitimately need goes inside one reachability boundary, an enclave scoped to that project, and everything else is not denied but absent. A deny rule must be ordered correctly and survive every configuration change; absence means no usable path is provisioned, enforced independently of application authorization; there is no application-layer decision in the path to subvert.
Two concrete cases. A semiconductor company runs an open-weight model locally for RTL generation on Project A; Project B's design database has no presence in Project A's world, even as a forbidden destination, and that bound holds whether the model is healthy, poisoned, or stripped of its alignment. A financial services firm runs a document summarizer over customer files for one business unit; the general ledger, the trading systems, and the other unit's files have no route from where the agent stands.
Effective reachability, assessed in five paths
The measure that matters is effective reachability: the full set of systems and data an agent can affect directly or through an intermediary. Assess it path by path, as a checklist rather than a framework.
Direct network paths: enumerate what is routable from the agent's environment, then test it; a connectivity probe from inside the boundary should reach only the declared set. Governed tool paths: enumerate the agent's tools and what each can touch, since a tool with broad access is effectively another network route. Shared-service paths: enumerate every service reachable from more than one project. Delegated-agent paths: enumerate the agents this agent can invoke, and take the union of their reach, because delegation is transitive. Portable credential paths: enumerate credentials on the endpoint that work somewhere else, since a reusable key travels even when the agent cannot.
The shared-service test
For each service reachable from two projects, ask three questions. Is it inside a boundary, governed and inspected. If not, is every cross-boundary exchange through it an explicitly governed broker, a narrow inspected interface, or a human-approved transfer. If neither, then it is the bridge, and the isolation story ends there whatever the network diagram says. Ticketing systems, chat platforms, artifact repositories, and object stores fail this test in most first assessments, which is the point of running it.
Why this ordering leads
Reachability sets the outer limit of what an agent can contact directly from its environment; credential and intermediary controls decide whether a compromise can propagate beyond it. Set that limit first, and every other control then operates within a survivable perimeter rather than standing alone in front of an unbounded one.
Where the control plane fits
Ensage AI enforces reachability with project-scoped enclaves on the CoIP Platform overlay, with zLink enforcing at the endpoint and the AI Session Controller governing the session path across the boundary, so the entitlement plane and the reachability plane fail separately by construction.
