Blast radius is the question you ask after something goes wrong: given that this identity was compromised or misbehaved, how much damage could it do. For an autonomous agent, the honest answer is usually "everything its credential can reach," and that credential is usually far too broad. The agent was given a wide database grant and a static key so it would not get blocked mid-task, and that convenience is now the size of the crater.
Why agents inflate blast radius
An agent's blast radius is large for reasons that are easy to fall into.
Over-provisioning by default. Nobody wants an agent to fail halfway through a task because it lacked a permission, so it gets granted broadly. The grant outlives the task and covers far more than any single run uses.
Standing credentials. A static key in the environment is reachable 24/7. An attacker who lands in the agent's process inherits everything that key can do, with no time limit.
Autonomy. The agent decides what to do next. If it is wrong, or steered wrong, it acts at machine speed across the full scope of its access before anyone notices.
Shared identity makes it worse. When several agents, or several tasks, run under one service account, the blast radius is not one agent's reach. It is the union of everything any of them was ever granted, all reachable through a single compromised key. The convenience of one account for the whole fleet quietly sums every permission into one target.
The lever that actually shrinks it
Blast radius is a function of two things: how much access the identity holds, and for how long. You shrink it by attacking both. Grant only the access the current task needs, and grant it only while the task runs. An agent that holds a task-scoped, time-bound grant has a blast radius the size of that task, not the size of your whole database.
The requirement that makes this real is placement. The thing that scopes and expires access has to sit outside the agent, on the connection to the infrastructure. If scoping is the agent's own responsibility, a compromised agent simply ignores it. Put the limit where the agent cannot move it.
Practical guidance
- Replace broad standing grants with just-in-time access scoped to the task.
- Time-box every grant. Access that expires on its own cannot be the basis for a slow-burn compromise.
- Route destructive operations through approval, so the worst actions cannot happen at machine speed unattended.
- Record everything at the command level, so when you do measure blast radius after an incident, you have the real reach, not a guess.
Where the gateway sits
hoop.dev is an open-source access gateway between identities and infrastructure. The agent connects through it instead of holding a direct, broad credential. The gateway grants just-in-time access scoped to the task, expires it when the task ends, can hold a risky command for human approval, and records every command at the protocol level. The agent's effective reach at any moment is the narrow grant the gateway issued, not a standing key, so the blast radius collapses to the task in front of it.
It governs the infrastructure actions the agent takes, not the prompt or the model's reasoning. Blast radius is about what an identity can do to your systems, which is the surface the gateway scopes.
The getting-started guide shows scoping a connection, and the learn library covers just-in-time access and approvals.
FAQ
What is the single biggest contributor to an agent's blast radius?
A broad standing credential. It gives the agent, and anyone who compromises it, far more reach than any task needs, with no time limit. Scoping and expiry shrink it the most.
Does approval slow the agent down too much?
Only on the operations you choose to gate, typically destructive or high-risk ones. Routine reads run normally, so the agent stays useful while the dangerous actions stay contained.
How does identity affect blast radius?
Run each agent or task under its own authenticated identity rather than a shared account. A compromise is then bounded by that identity's narrow grant, instead of the combined reach of every agent sharing one key.
Measure it against the real path
To trust how access is scoped and expired, read it. hoop.dev is open source on GitHub, where the access-scoping and approval code is open to inspection.
