The Blast-Radius Guard: A Fail-Closed Architectural Pattern for Bounding Machine-Initiated Action in Production Systems

Abstract

An autonomous remediation agent acting on a calibrated confidence of 0.93 is wrong seven times in a hundred, and at machine frequency the wrong actions arrive weekly, unattended. Calibration and retrieval work lower how often such an agent is wrong; neither bounds what a wrong action costs. This article specifies the blast-radius guard, a subsystem outside the model that checks every unattended action against pre-declared impact bounds and demotes anything over-bound to human review, whatever the model's confidence. Three hardenings separate a guard from a policy file, and each is stated as a formal predicate. The guard fails closed when its own inputs are stale, which makes autonomy anti-correlated with incident severity, a property the operator owns in advance rather than discovers in a war room. Headroom counts only replicas observed serving real traffic, because a gray-failed replica keeps passing health probes long after it stops doing the work. A cumulative per-incident action budget, serialized through a single writer, stops individually bounded actions from compounding out of bounds. The three compose into one fail-closed admission rule, backed by a coarse enforcement substrate that makes the catastrophic categories unreachable even when the guard itself fails open. Bound the damage structurally, before the action runs, and high-confidence-but-wrong becomes survivable; leave it to a probability estimate, and the tail is only a matter of time.