Agents that can act: blast radius before autonomy theater

An agent that sequences tools is a permission graph with a loop. Map blast radius before you celebrate autonomy. Autonomy is a marketing noun; blast radius is an ops noun. Lead with what the agent can touch, how long it can run, and who can stop it — before any “agentic” framing. Demo autonomy is not production permission. Done when a reader can draw a one-page blast-radius sketch for an agent before enabling a connector.

---

1. Opener: Chat that can click is not chat

Chat that can click is not chat.

The friendly face still looks like a conversation: a box, a reply, a “helpful” tone. Under that face sits a loop that can choose the next tool call without a fresh human sentence each time. Mail. Files. Tickets. Browser. Calendar. APIs. Indexes. Each hop is a permission. Chained hops are a permission graph. The loop turns the graph into a moving blast radius.

Autonomy is a marketing noun. Blast radius is an ops noun. Marketing celebrates “agentic” as if the noun were the control. Ops asks three questions before the celebrate slide:

• What can it touch? — systems in scope, read versus write
• How long can it run? — one tool call versus a loop with retries and parallel calls
• Who can stop it? — real gate, mid-run revoke, audit trail that names the hop

If those answers are vibes, you do not have an agent readiness story. You have autonomy theater.

This field note is S3 #15 — AI × Data Security where action meets data paths. It does not relaunch Foundations. It does not sell a suite. It maps blast radius before enable. Soft claimState: promise. Literacy, not theater.

AI Caramba explains. Named platforms can appear later when a Learn-backed fact is required. They are not the opener and not the product being sold here.

---

2. Light layer recall: model → tool → agent loop

Keep the layer cut short. Pointer only — do not relaunch the foundations series.

• Model generates. Tokens in, tokens out. Risk class: wrong answers, leaked prompt content, instruction conflict inside a session.
• Tool reaches outward. Connectors, function calls, browser actions, file reads, ticket updates, retrieval over an index. Risk class: what leaves, what is stored, what can be replayed, who can trigger the hop.
• Agent sequences both. It chooses the next step. It may chain tools until a stop fires — or until nobody is watching. Risk class: accumulated context, retries, parallel calls, write hops that fire while the UI still looks like chat.

Three failures, three first questions, one loop:

Layer	Dominant failure shape	First question
Model	Wrong or over-shared text inside a boundary	What left the session as text?
Tool	Reach without a new paste each time	What systems can it read or change without a new human click?
Agent	Permission graph that keeps moving	What can it touch, how long can it run, who can stop it?

Mixing the layers makes every control debate louder than it needs to be. A better system prompt does not shrink a write grant. A prettier confirm dialog does not become a stop condition. Name the layer, then map the radius.

Earlier S3 notes already framed the path story: #12 (when an AI tool becomes a data path), #13 (paste as shipping label), #14 (retrieval as bounded fetch). This note is the loop chapter. Generation meets movement meets continued action.

---

3. Blast-radius map before enable

Sketch the map in one page before you enable a connector. Branding is a bad classifier. Paths and permissions are the classifier.

Systems in scope

Name systems the agent identity can reach: mailboxes, drives, ticket queues, wikis, CRM objects, calendars, browsers, CI, cloud consoles, internal APIs. “The assistant can help with work” is not a name. “This identity can read these three mailboxes and cannot send” is a name. If the list is vague, treat every connector as over-scoped until proven otherwise.

Read vs write

Read-only exposure is smaller than write. Smaller is not zero. A read path can still exfiltrate by summarizing, quoting, or stuffing sensitive fields into an answer that gets forwarded. Write adds irreversible hops: send, update, delete, post, merge, approve. If you cannot list what may change outside the chat, you do not have a control story — you have hope attached to a face.

Secrets in the environment

Agents inherit whatever the runtime can see: API keys, service principals, .env files, browser cookies, vault mounts, shared bot tokens, long-lived OAuth grants. The model did not “learn” those secrets in training. The tool layer can still pass them as arguments, headers, or side effects. Map secrets as blast-radius fuel, not as a separate vibes category.

Parallel tool calls and retries

One watched tool call is a different radius than parallel calls that fan out while a human is still reading the first confirm. Retries accumulate context and can re-attempt a write after a soft failure. Loops that “keep going until done” expand the map every turn. Count parallelism and retry policy on the sketch — not only the happy-path demo.

Approval gates: real vs decorative

A gate that can actually stop a hop is a control. A prompt that always gets rubber-stamped is decorative intent. Real gates fail closed, log the decision, and do not silently retry around the human. Decorative gates train operators to click yes. “It asked first” is not a control if the answer is always yes.

Map those items before you argue about products. The sketch is the done-when artifact of this field note — not a maturity score.

---

4. Stop conditions are controls, not vibes

Stop conditions are controls. They are not a slide about “responsible AI.” Write them as operators you can demonstrate.

Max steps

Cap the loop. A maximum step count, a maximum wall-clock, a maximum tool-call budget — pick what you can enforce. Endless “until done” is demo language. Production needs a number the runtime honors. When the cap fires, the run ends; it does not quietly ask for one more hop.

Human gate on write

Separate read proposals from write execution. A human gate on write paths should be able to refuse, edit, or cancel — and the refusal should stick. Batching twenty writes behind one “approve all” collapses the gate back into theater. Prefer narrow, inspectable hops when integrity matters.

Revoke path

Kill the run mid-path. Revoke the connector grant. Rotate the identity. Quarantine the thread. Disable the schedule. If revoke only works after a long vendor ticket, you do not have mid-path control. Mark uncertainty as promise until you can demonstrate the kill on a non-production run.

Audit trail of tool calls

Log what fired: tool name, arguments class (not every secret in cleartext on a shared screen), system touched, read vs write, who or what triggered, approve/deny, timestamp, run id. An audit trail that cannot answer “what did it touch between 14:00 and 14:07?” is decoration. Trail quality is part of blast-radius literacy — not a suite opener.

Four stop operators rhyme with the #12 praxis spine (what left / what persisted / who triggers / revoke mid-path). Agents add the loop clause: the loop stops when ___ ; mid-run revoke is ___ ; write requires ___ ; the trail shows ___. Empty blanks mean demo, not production.

---

5. Anti-theater: demo autonomy ≠ production permissions

Demo autonomy is not production permission.

A recorded loop that books a meeting, files a ticket, and summarizes a mailbox looks like progress. Ops still asks whether the identity was over-scoped, whether write was gated, whether revoke was tested, and whether the audit trail would survive an incident review. Green checkmarks in a keynote do not shrink a shared service account.

Common theater patterns — name them so you can refuse them:

• Autonomy as a feature checkbox. Shipping “agents” without a blast-radius sketch.
• Rubber-stamp confirms. Ten identical prompts; humans learn to click yes.
• Shared god-identity. One bot token that can see and change everything the demo needs.
• Silent retries. Soft failures that re-attempt writes without a new human decision.
• Soft delete as revoke. UI says stopped; the schedule, grant, or worker keeps going.
• Prompt policy as control plane. A system prompt that says “be careful” while tools still hold write.

Treat every new connector as an expansion of blast radius until the map says otherwise. Shrink scope first. Add loop length second. Celebrate autonomy last — if at all.

Purview-no-Suite-Sell stays in force: when data platforms enter later pieces, frame govern / protect / manage and Docs-loyal names. Do not open with laundry lists, license SKUs, or leaderboard numbers. Buying a portal does not retire the sketch.

---

6. One-page sketch: the done-when artifact

Done when a reader can draw a one-page blast-radius sketch for an agent before enabling a connector. The sketch is operational, not artistic.

Minimum fields on the page:

1. Agent / run identity — human-delegated, shared bot, or service principal (name it)
2. Systems touched — boxes with read / write edges
3. Secrets in env — classes of credential the runtime can pass (not the secrets themselves)
4. Loop bounds — max steps / time / tool-call budget; parallel allowed? yes/no
5. Gates — which hops need a human; which gates are real stops vs decorative
6. Stop / revoke — how you kill mid-run; who is on-call to do it
7. Audit trail — where tool calls land; how long you can answer “what fired?”

If any field is blank, you are not ready to point the loop at production data. Blank is information. Fill or refuse.

Do not turn the sketch into a fake maturity score. Do not invent percentages of “safer agents.” claimState stays promise. The sketch sorts setups; it does not grade brands forever. The same product can be a narrow pilot on Monday and a wide blast radius the day write connectors go on.

---

7. What this piece is not

Clear negatives save time — outline non-goals, said as operator copy:

• Not autonomy theater. Demo loops are not production permissions.
• Not a feature matrix. Matrices come after you can name systems, edges, and stops.
• Not a suite pitch. Purview-no-Suite-Sell holds. Path and permission questions first; named controls only when a practice question needs a Learn-backed fact.
• Not a relaunch of S1. Model / tool / agent recall stays light. Foundations titles stay on their rails.
• Not a fear headline. Risks stay sober and paired with stop conditions and revoke. Angst-marketing is not editorial.
• Not invented metrics. No fake Kennzahlen, no “X% of agent breaches,” no traction theater.
• Not a claim that agents are useless. Loops can be useful. The error is mistaking a demo for a blast-radius map.

Platforms — including Microsoft Purview and related Docs concepts such as govern, protect, and manage data in the era of AI — can appear when a Learn-backed fact is required. Order stays: category and blast-radius questions first. kombify is not the subject of this line.

---

8. How this fits the reading path

Arc for the blog: Early Foundations → Data Security → AI × Data Security.

Current Lesepfad preference: S3-first if you already live with assistants, connectors, and loops. This field note is the action / loop chapter (#15). Foundations vocabulary (see / do / remember; model / tool / agent) remains optional backfill — without rewriting those titles here.

Light back/forward pointers (titles, not invented URLs):

• #12 — When an AI tool becomes a data path (generation meets movement)
• #13 — Putting business data into a prompt: a practical risk checklist (paste as transfer)
• #14 — Retrieval and RAG: useful, leaky if unbounded (fetch-then-generate as a bounded path)
• #15 — this note — agents that can act: blast radius before autonomy theater
• #16 — AI Security as a reading path: foundations → data → intersection (map / closer)

Rails stay navigation: this piece is a field-note. Pick the next article from the path; do not shop a suite.

---

9. Close: Map first, autonomy later

Chat that can click is not chat. An agent that sequences tools is a permission graph with a loop.

Light recall only: model generates, tools reach, the agent chooses the next hop. Blast radius follows systems in scope, read vs write, secrets in env, parallel calls, and whether gates are real stops or decorative prompts. Stop conditions are operators — max steps, human gate on write, revoke mid-path, audit trail of tool calls. Demo autonomy is not production permission.

Done when a reader can draw a one-page blast-radius sketch for an agent before enabling a connector — without a feature matrix, without a suite pitch, and without inventing a score.

Status: draft / PROMISE. No publish. No Live wire from Caramba. No suite sell. No invented metrics. Review: kombinator2.

---

Series path: S3 AI × Data Security · slot #15 · rail field-note. Companion spine: see/do/remember · model/tool/agent · #12 path questions. Next: #16 reading-path closer.

 S3 first-wave · not final editorial · no suite pitch