Agents that can act: blast radius before autonomy theater

Chat that can click is not chat.

An agent that sequences tools is a permission graph with a loop. Map blast radius before you celebrate autonomy.

Autonomy is a marketing noun. Blast radius is an ops noun. Lead with what the agent can touch, how long it can run, and who can stop it — before any “agentic” framing.

Sketch the map in one page. Which systems are in scope? Read or write? Which secrets sit in the environment? Can it fire tools in parallel? Which approval gates are real stops, and which are decorative prompts a tired human will rubber-stamp?

Stop conditions are controls, not vibes: max steps, a human gate on write paths, a revoke that actually kills the run, and an audit trail of tool calls. “It asked first” is not a control if the answer is always yes.

Demo autonomy is not production permission. Treat every new connector as an expansion of blast radius until the map says otherwise. Light layer recall only: the model generates, tools reach outward, the agent chooses the next step — three failures, three mitigations, one loop.

This field note is AI × Data Security where action meets data paths. No suite sell. No invented metrics. Named platforms later only with Learn-backed facts.