# E02 explained: the blast radius, frame by frame > How studio experiment E02 turns one example agent's reach into its grant rows: each frame with its time, the data behind every number, the technique, and what was tried and left out. *Source: · site v0.1.71 · generated from the same content as the page, so the two cannot drift.* --- Studio experiment E02 · the explainer # The blast radius, frame by frame The one sentence: if one agent inside the company goes wrong, the damage reaches everything its grant reaches, and the grant is far larger than what it is for. E01 ended on a shaded reach; E02 turns that shading into the rows it is made of. ## The frames (v1) v1, seconds from the start; it ends at 54 s and holds still. v2 keeps the same order a second later in places: dots from 5 s, the mandate at 13 s, the excess groups from 19 s, the shortfall (a dashed dot with a cross) at 28 s, the glyphs at 35 s, the end at 56 s. The summary line at the top left changes with each step; the rows on the right keep everything that came before. | From | What is on screen | | 0 s | The reach, as E01 left it: one shaded disc round the model. | | 5 s | The disc breaks into one dot per grant row, 16 in all, placed by how far each is from what the agent is for: the mandate close in, what the mandate leaves unstated further out, what it refuses furthest out. | | 13 s | The mandate lights up as a small core: the 4 mandate items that are granted, listed on the right. | | 19 s | The excess: 16 granted minus 4 = 12, listed as 2 unstated and 10 refused. This is the blast radius. | `` | 27 s | The shortfall: one thing the mandate asks for and the grant does not give, send.endpoint.allowed, shown as an empty dashed dot on the core, labelled "asked, not granted", and struck through in the list. From 34 s the summary keeps the arithmetic (16 minus 4 = 12) beside the barrier line, so the still carries both. | | 34 s | The barrier kind on every row (none, expectation, setting, boundary, with abp.sgit.ai's glyphs): 12 of the 12 excess rows have no control in the way, which sets up part two. | ## Where every number comes from Only from [abp-examples.json](../../studio/data/abp-examples.json), the researcher's capture for the studio, read by the slide when it loads, so a corrected file corrects the slide. The example is abp.sgit.ai's "a coding agent on your own machine, confirmations on" (the Claude Code CLI): `grant` 16, `mandate` 5, `aligned` 4, `excess` 12, `unbounded_excess` 12, `shortfall_capabilities` one. The dots and rows are the file's 16 `rows`, placed by each row's `mandate_stance` (authorised, unstated, refused) and marked with its `barrier_kind`. - **Why 16 minus 4, not 16 minus 5.** One of the mandate's five items is not in the grant (the shortfall), so only four are granted, and the excess is 16 minus 4. The data file says so in its note on this example. - **A published draft, not a measurement.** Every row is derived from what a CLI running as your account is; abp.sgit.ai records 0 of 22 tool-level rows measured, and its mandate is the site's own first draft. The slide says so on screen. - **A description, not a judgement.** The policy describes what the agent can do, what it is for and what stands in the way; it gives no risk score, and neither does the slide. - **The model's definitions** (grant, mandate, delta, the four barrier kinds) are RiskMandate's Agent Behaviour Policy and abp.sgit.ai's, as quoted in the data file. ## Technique - One slide on the engine, driven: SVG built once from the data, then every frame drawn from the slide's clock by `SLIDE_RENDER`, so the player can seek, pause and replay it, and `?static` shows the whole picture. - Colour carries one meaning: the agent red for the excess, the heading colour for the mandate core. Every text is 20 px or larger on the 1280 by 720 canvas. ## What was tried and left out - **Names on the dots** (v1). Sixteen capability names round a circle at a readable size do not fit, so v1 kept them in the list; v2 numbers the dots instead and leads each line with the same number. - **The other four examples** in the file (confirmations off, a chat window with nothing connected, a browser extension, a CI runner). Left for a comparison piece: with confirmations off the same 16 rows move only one barrier, which is a story of its own. - **A two-line headline** ran into the summary; the headline was cut to one line. ## v2, after deck's review deck kept the data treatment and asked for five changes; v2 makes all five, and keeps v1's timings within a second. - **Numbered dots.** Each of the 16 dots carries a number, and the same number leads its line in the list, so a dot and its row are tied without a line across the slide. - **Plain words first, the id beneath.** The data file gives each capability as an id (`verb.object.reach`) and no description, so the plain words are a reading of that grammar written for this slide (for example `read.credential.host` as "read credentials on the machine"), and the slide says so. The gap is reported to deck in the reply for this run, so a description can be added to the file. - **Grouped by what it touches.** The 12 excess rows in five groups by the id's noun: files and disk (3), credentials (4), network and world (2: the two rows whose reach is the world), records and repositories (2), schedule (1). Each row is in one group only. - **Two distances.** The rings are labelled: the mandate (4 granted), unstated (2), refused (10). - **The glyph on each dot**, from 35 s: abp.sgit.ai's filled circle for nothing in the way, double circle for a rule in prose, half filled for a switch the agent's own account can flip. In this example that marks one rule in prose and two switches (one of them on a mandate row); the other 13 rows have nothing in the way. The last summary line carries the key to the shapes. - **It runs only over HTTP.** The slide reads its data with `fetch` when it loads, so opened as a file from disk it shows the frame and no rows; on the site, or any local web server, it works. ## How it was made v1 in ruv.sgit run r5-e02-blast-radius, v2 in run r7-e02-v2, a second pass on the same vault: a Ruflo hive with a builder and an editor who checked the slide and this page against the request and the data, and one sgit vault holding the request, each worker's branch and the history. Its row is in [the ledger](../../ruv-sgit/vaults.json). --- *[Site index for agents](../../llms.txt) · [HTML version](https://the-ultimate-insider.presentation.sgit.ai/ruv-sgit/blast-radius/explainer.html)*