{"course":{"slug":"ai-for-small-business","title":"AI for a Small Business","url":"https://addaly.com/learn/ai-for-small-business","level":"beginner","track":"work"},"lesson":{"slug":"blast-radius","title":"Blast radius: what one confused run can reach","url":"https://addaly.com/learn/ai-for-small-business/blast-radius","position":62,"of":88,"minutes":9,"answer":"Automations should be given the narrowest access that does the job, in their own account with their own revocable key.","keyIdea":"Automations should be given the narrowest access that does the job, in their own account with their own revocable key, because the question is never whether something will go wrong but how much a single wrong run can touch."},"body":{"format":"markdown","text":"## The question to ask before switching anything on\n\nNot \"will this work?\" but \"if this runs wrong two hundred times tonight, what will I be repairing tomorrow?\"\n\nThat is blast radius, and it is decided entirely by what you connected, not by how good the prompt is.\n\n## Give it its own account\n\nThe commonest and worst setup is an automation running under the owner's login. It inherits everything: every folder, every mailbox, every permission accumulated over six years, including the ones the owner has forgotten they have.\n\nInstead, make a separate account for the automation (`automation@yourbusiness`) and share with it only the specific folder, calendar or inbox it needs. This costs one extra seat on most platforms, sometimes nothing, and it converts \"it can reach everything\" into \"it can reach one folder\".\n\nIt also gives you a clean audit trail. When something odd is filed at 03:40, the log shows who did it, and the answer is not ambiguous.\n\n## Read and write are different permissions\n\nMost platforms let you grant read without write, and most people grant both out of habit because the setup screen makes it one click.\n\nSeparate them deliberately:\n\n- An automation that summarises orders needs **read** on orders. Nothing else.\n- One that files documents needs **write** on one folder, not the drive.\n- One that drafts replies needs **draft** permission, which several mail providers expose separately from **send**. Use it.\n\nThe difference is not theoretical. Read-only access that misbehaves produces a wrong summary. Write access that misbehaves produces two hundred modified records and a restore from backup, assuming you have one.\n\n## Keys, and where they must not be\n\nAn API key is a password that works from anywhere and is usually not protected by anything else. Treat it exactly as you would the bank login.\n\n- One key per automation, so you can revoke one without stopping the rest.\n- Never in a message, a shared document, a screenshot, or a spreadsheet cell. Keys pasted into a team chat are among the most common ways small businesses get an unexpected bill.\n- Rotate when anybody with access leaves.\n- Set the spending cap per key where the provider allows it.\n\nIf a key has ever been in a message, treat it as public and replace it. Revoking is free; discovering later that somebody has been using your account is not.\n\n## The connection you forgot you made\n\nBlast radius grows by accretion rather than by decision. You connect the automation to your drive to read one folder, and six weeks later somebody moves a folder of scanned contracts into the same drive. Nobody granted anything; the boundary moved because the contents did.\n\nThis is why access should be granted to the narrowest container the platform allows (a specific folder, a specific label, a specific calendar) rather than to the account that holds it. The narrow grant survives somebody reorganising the filing; the broad one silently expands to include whatever arrives.\n\nThe same applies to integrations sold as one-click. \"Connect your mailbox\" usually means full read and send on everything, including the folder with your bank correspondence in it. Read the permission screen rather than clicking past it; it is the only moment the software will tell you the truth about what it is taking.\n\n## Bound the action itself\n\nPermissions limit what it can reach. Rules limit what it can do with what it reached, and you want both.\n\n- A maximum per run: \"no more than twenty emails an hour\", \"no invoice above USD 500 without a person\".\n- An allow-list where you can: it may send only to addresses already in your customer records.\n- A stop condition: if more than three actions fail, halt and notify rather than continuing.\n\nThese are trivial to write and they are what turns a bad night into a bad ten minutes.\n\n## Backups, which now matter more\n\nAutomation makes a bad backup situation worse, because the damage arrives faster and looks legitimate. Two questions worth answering before you connect anything with write access.\n\nHow would you restore your customer records if four hundred of them were modified incorrectly overnight? And do you have a copy that a compromised key could not also reach, which is what \"offline\" or \"separate account\" means in practice?\n\nA cloud provider's version history usually covers this and is usually switched on. Usually is not a plan. Check, and check that you know how to use it under pressure, because the afternoon you need it is not the afternoon to learn.\n\n## The five-minute review\n\nOnce a quarter, for every automation you run: what account does it use, what can that account see, what can it change, which key does it hold, and what is the per-run limit.\n\nMost businesses doing this for the first time find at least one automation with access to something it has not needed since the second week. Remove it. The cost of over-permission is zero right up until the day it is the entire problem."},"check":{"question":"A practice connects a booking-summary automation using the owner's own login because it was quickest, and sets a strict prompt forbidding it from touching anything except the bookings calendar. Why is this weaker than a separate account with calendar-only access?","options":[{"text":"Because prompts are stored in plain text and could be read by anyone with access to the automation platform, who could then alter the restriction.","correct":false,"tempting":"Raises a real hygiene issue about platform access, but the restriction's weakness is not that someone might edit it."},{"text":"Because the owner's login will eventually have its password changed, breaking the automation and requiring it to be rebuilt with the correct permissions anyway.","correct":false,"tempting":"Describes a genuine operational annoyance rather than the security difference between an instruction and a permission."},{"text":"Because platform logs will attribute the automation's actions to the owner, making it impossible to prove which changes were automated if a dispute arises later.","correct":false,"tempting":"The audit confusion is real and is a secondary benefit of separation, not the reason the prompt fails to contain anything."},{"text":"Because the prompt is an instruction the model may ignore, while the permission is a boundary the platform enforces.","correct":true}]},"prev":{"slug":"what-an-agent-actually-is","title":"What an agent is underneath, and why ten steps go wrong","url":"https://addaly.com/learn/ai-for-small-business/what-an-agent-actually-is"},"next":{"slug":"the-duplicate-problem","title":"The duplicate problem, and the one line that fixes it","url":"https://addaly.com/learn/ai-for-small-business/the-duplicate-problem"},"authorship":"Founder and series editor: Dr Mustafa Mun. Written by AI models to a written standard. Exam keys checked blind by a second model: 3,665 of 3,666 agreed. Academic review invited.","review":{"status":"Draft, open for academic review"},"cite":"Addaly (2026) 'Blast radius: what one confused run can reach', in AI for a Small Business. Edited by M. Mun. Addaly. Available at: https://addaly.com/learn/ai-for-small-business/blast-radius (Accessed: 13 October 2026).","licence":{"name":"CC BY-NC-SA 4.0","url":"https://creativecommons.org/licenses/by-nc-sa/4.0/"},"reader":{"schema":1,"title":"Blast radius: what one confused run can reach","courseTitle":"AI for a Small Business","module":{"index":7,"slug":"letting-it-act","title":"Letting it act: automation you can trust with the keys"},"answer":null,"keyIdea":"Automations should be given the narrowest access that does the job, in their own account with their own revocable key, because the question is never whether something will go wrong but how much a single wrong run can touch.","hero":{"kind":"plate","image":null,"alt":null,"caption":null},"blocks":[{"t":"h2","id":"the-question-to-ask-before-switching-anything-on","runs":[{"text":"The question to ask before switching anything on"}]},{"t":"p","runs":[{"text":"Not “will this work?” but “if this runs wrong two hundred times tonight, what will I be repairing tomorrow?”"}]},{"t":"p","runs":[{"text":"That is blast radius, and it is decided entirely by what you connected, not by how good the prompt is."}]},{"t":"h2","id":"give-it-its-own-account","runs":[{"text":"Give it its own account"}]},{"t":"p","runs":[{"text":"The commonest and worst setup is an automation running under the owner’s login. It inherits everything: every folder, every mailbox, every permission accumulated over six years, including the ones the owner has forgotten they have."}]},{"t":"p","runs":[{"text":"Instead, make a separate account for the automation ("},{"text":"automation@yourbusiness","code":true},{"text":") and share with it only the specific folder, calendar or inbox it needs. This costs one extra seat on most platforms, sometimes nothing, and it converts “it can reach everything” into “it can reach one folder”."}]},{"t":"p","runs":[{"text":"It also gives you a clean audit trail. When something odd is filed at 03:40, the log shows who did it, and the answer is not ambiguous."}]},{"t":"h2","id":"read-and-write-are-different-permissions","runs":[{"text":"Read and write are different permissions"}]},{"t":"p","runs":[{"text":"Most platforms let you grant read without write, and most people grant both out of habit because the setup screen makes it one click."}]},{"t":"p","runs":[{"text":"Separate them deliberately:"}]},{"t":"ul","items":[[{"text":"An automation that summarises orders needs "},{"text":"read","b":true},{"text":" on orders. Nothing else."}],[{"text":"One that files documents needs "},{"text":"write","b":true},{"text":" on one folder, not the drive."}],[{"text":"One that drafts replies needs "},{"text":"draft","b":true},{"text":" permission, which several mail providers expose separately from "},{"text":"send","b":true},{"text":". Use it."}]]},{"t":"p","runs":[{"text":"The difference is not theoretical. Read-only access that misbehaves produces a wrong summary. Write access that misbehaves produces two hundred modified records and a restore from backup, assuming you have one."}]},{"t":"h2","id":"keys-and-where-they-must-not-be","runs":[{"text":"Keys, and where they must not be"}]},{"t":"p","runs":[{"text":"An API key is a password that works from anywhere and is usually not protected by anything else. Treat it exactly as you would the bank login."}]},{"t":"ul","items":[[{"text":"One key per automation, so you can revoke one without stopping the rest."}],[{"text":"Never in a message, a shared document, a screenshot, or a spreadsheet cell. Keys pasted into a team chat are among the most common ways small businesses get an unexpected bill."}],[{"text":"Rotate when anybody with access leaves."}],[{"text":"Set the spending cap per key where the provider allows it."}]]},{"t":"p","runs":[{"text":"If a key has ever been in a message, treat it as public and replace it. Revoking is free; discovering later that somebody has been using your account is not."}]},{"t":"h2","id":"the-connection-you-forgot-you-made","runs":[{"text":"The connection you forgot you made"}]},{"t":"p","runs":[{"text":"Blast radius grows by accretion rather than by decision. You connect the automation to your drive to read one folder, and six weeks later somebody moves a folder of scanned contracts into the same drive. Nobody granted anything; the boundary moved because the contents did."}]},{"t":"p","runs":[{"text":"This is why access should be granted to the narrowest container the platform allows (a specific folder, a specific label, a specific calendar) rather than to the account that holds it. The narrow grant survives somebody reorganising the filing; the broad one silently expands to include whatever arrives."}]},{"t":"p","runs":[{"text":"The same applies to integrations sold as one-click. “Connect your mailbox” usually means full read and send on everything, including the folder with your bank correspondence in it. Read the permission screen rather than clicking past it; it is the only moment the software will tell you the truth about what it is taking."}]},{"t":"h2","id":"bound-the-action-itself","runs":[{"text":"Bound the action itself"}]},{"t":"p","runs":[{"text":"Permissions limit what it can reach. Rules limit what it can do with what it reached, and you want both."}]},{"t":"ul","items":[[{"text":"A maximum per run: “no more than twenty emails an hour”, “no invoice above USD 500 without a person”."}],[{"text":"An allow-list where you can: it may send only to addresses already in your customer records."}],[{"text":"A stop condition: if more than three actions fail, halt and notify rather than continuing."}]]},{"t":"p","runs":[{"text":"These are trivial to write and they are what turns a bad night into a bad ten minutes."}]},{"t":"h2","id":"backups-which-now-matter-more","runs":[{"text":"Backups, which now matter more"}]},{"t":"p","runs":[{"text":"Automation makes a bad backup situation worse, because the damage arrives faster and looks legitimate. Two questions worth answering before you connect anything with write access."}]},{"t":"p","runs":[{"text":"How would you restore your customer records if four hundred of them were modified incorrectly overnight? And do you have a copy that a compromised key could not also reach, which is what “offline” or “separate account” means in practice?"}]},{"t":"p","runs":[{"text":"A cloud provider’s version history usually covers this and is usually switched on. Usually is not a plan. Check, and check that you know how to use it under pressure, because the afternoon you need it is not the afternoon to learn."}]},{"t":"h2","id":"the-five-minute-review","runs":[{"text":"The five-minute review"}]},{"t":"p","runs":[{"text":"Once a quarter, for every automation you run: what account does it use, what can that account see, what can it change, which key does it hold, and what is the per-run limit."}]},{"t":"p","runs":[{"text":"Most businesses doing this for the first time find at least one automation with access to something it has not needed since the second week. Remove it. The cost of over-permission is zero right up until the day it is the entire problem."}]}],"check":{"question":[{"text":"A practice connects a booking-summary automation using the owner’s own login because it was quickest, and sets a strict prompt forbidding it from touching anything except the bookings calendar. Why is this weaker than a separate account with calendar-only access?"}],"options":[{"text":[{"text":"Because prompts are stored in plain text and could be read by anyone with access to the automation platform, who could then alter the restriction."}],"correct":false,"tempting":[{"text":"Raises a real hygiene issue about platform access, but the restriction’s weakness is not that someone might edit it."}]},{"text":[{"text":"Because the owner’s login will eventually have its password changed, breaking the automation and requiring it to be rebuilt with the correct permissions anyway."}],"correct":false,"tempting":[{"text":"Describes a genuine operational annoyance rather than the security difference between an instruction and a permission."}]},{"text":[{"text":"Because platform logs will attribute the automation’s actions to the owner, making it impossible to prove which changes were automated if a dispute arises later."}],"correct":false,"tempting":[{"text":"The audit confusion is real and is a secondary benefit of separation, not the reason the prompt fails to contain anything."}]},{"text":[{"text":"Because the prompt is an instruction the model may ignore, while the permission is a boundary the platform enforces."}],"correct":true,"tempting":null}],"order":[1,2,0,3],"why":null},"prev":{"slug":"what-an-agent-actually-is","title":"What an agent is underneath, and why ten steps go wrong","minutes":10},"next":{"slug":"the-duplicate-problem","title":"The duplicate problem, and the one line that fixes it","minutes":8}}}