The blast-radius test

When I am scoping a build, I run a quick scan I call the blast-radius test to find the irreversible actions before they find me. It is four questions, and they catch almost everything that can hurt you.

Does it move money? Does it deploy to production? Does it send something to another human? Does it delete data? Money, deploys, sends, deletes. If an action does any of those four, it goes in the irreversible bucket and it gets a gate, no exceptions, no matter how confident the model is.

Why these four specifically?

Because each one crosses a boundary you cannot uncross. Money that leaves your account is gone until someone chooses to send it back, and they may not. A production deploy is live to every user the instant it lands. A sent email or message is in someone else's inbox, and there is no unsend that actually unsends, only a correction that admits the first one was wrong. A hard delete removes the thing and, often, the ability to prove it ever existed. The boundary is the point. Reversible actions stay on your side of it; these four step over.

Notice what is not on the list. Writing to a scratch file, editing on a branch, generating a draft, querying data without changing it. Those have essentially no blast radius, so they get speed. The test is not "is this important," it is "if this goes wrong, how far does the damage spread and can I pull it back." A trivial-looking action with a wide blast radius, like a script that emails your whole list, is far more dangerous than an important-feeling one that only touches a branch.

The trap I want you to avoid is the disguised irreversible. Some actions look small and are not. A config change that flips a live feature flag. A database migration that drops a column. A "quick" bulk update with no backup. Run the four questions on everything, especially the actions that feel routine, because routine is exactly when the blast radius sneaks past you.

The takeaway: Money, deploys, sends, deletes. If an action does any of those four, it is irreversible and it needs a gate, and the size of the blast radius matters more than how important the action feels.