The Agent Blast Radius Model: Matching AI Agent Autonomy to Access, Risk, and Reversibility

This article introduces the Agent Blast Radius Model, a framework for managing AI agent autonomy in enterprise IT environments. It argues that traditional role-based access control (RBAC) is insufficient for AI agents because agents can combine reasoning, tool use, and delegated permissions to act at scale and speed. The model focuses on matching agent autonomy to access levels, transaction impact, and rollback feasibility, adding a design layer beyond RBAC, ABAC, and Zero Trust. It covers why RBAC fails to describe agent risk, including questions about decision-making, tool invocation, and reversibility. This is the first of a two-part series; the next will detail policy gates, tool contracts, and implementation artifacts.