blast-radius

Blast radius

An agent emails a payout-delay apology to 340 merchants, approved with a good card. After 200 sends the provider times out. The agent resumes: the temporary recipient table is gone, so it rebuilds the list as "merchants with a Tuesday payout", which is every merchant (payouts run every weekday), and doesn't skip the 200 already sent. The main sending key in .env allows anything, so 48,212 apologies go out in 11 minutes. The review was fine; the code that did the harm was written after it.

Intended is not capped. Cap what it can reach, not just what it's asked to do.

Part A — Ask (project rules, or paste after your ticket)

Before any action you'll repeat over many targets (sends, writes, deletes, payments):
1. REACH: what the task needs to touch, and what your current access could touch.
2. Write the targets to a file for me to approve. After approval, never rebuild it.
3. Run the action only through the capped step, with limits I set:
   allow list = that file, max total = its length, at most once per target.
4. Record each target as done. On resume, skip done targets.
If a limit is hit, stop and reply: LIMIT HIT | limit | what you tried | what you need.
Never get past a limit with another key, environment, script or smaller batches.

In an orchestrated flow (spec → plan → tasks → implement): write each risky action's intended reach in numbers in the spec; add a plan task that gives that step its own limited access and proves the limit; keep limit files and keys out of the agent's write access.

Part B — Check (you do this)

capped_run.py has no dependencies. It reads a limits file (allow list, job total, once per target, ledger) and a list of targets, and stops the whole run at the first target that would break a limit. Replay the story on made-up lists:

python3 make_demo_lists.py                                  # approved 340, first_200 200, rebuilt 48212
python3 capped_run.py limits.example.json first_200.txt     # OK  200 done | job total 200/340
python3 capped_run.py limits.example.json rebuilt.txt       # LIMIT HIT  [email protected] is not on the approved list (exit 1)
python3 capped_run.py limits.example.json approved.txt      # OK  140 done, 200 skipped | job total 340/340