Blast Radius Budget

Blast Radius Budget treats every automated workflow as a spend of trust: the more autonomy an agent gets, the smaller the radius of damage it must be able to cause before a human checkpoint fires. Agencies scope security not by counting tools but by mapping what each automation can touch (client CRM records, ad accounts, production repos, payment keys) and capping the worst-case outcome. A workflow that drafts copy can run unattended; one that sends client-facing email or rotates credentials cannot. The budget is set per client, per retainer tier, and reviewed when scope expands. The failure mode is real: exposed API keys in AI-built client apps have produced bills above $4,000 from unauthorized calls, a cost that lands on the agency's invoice and reputation, not the model vendor's. Pair the budget with runtime controls such as Vaultak's action interception or Cogent's attack-path mapping so the cap is enforced, not just documented.