Outcome
By the end of this lesson, you will be able to state the question blast radius answers, explain why it traverses only one hop, and read the canvas overlay it produces.
| Tier | Engineer |
| JTBD | ”Know what else breaks before I click Apply on this recommendation.” |
| Personas | Platform Engineer · SRE · Engineering Leader |
| Prerequisites | M2.1.L5 (reading a recommendation card) |
| Time | 9 minutes |
| Bloom verb | State (Remember), Explain (Understand), Read (Apply) |
1. Concept
Every recommendation you have met so far answers “what will this save”. Blast radius answers the other half of the decision:
What else does this touch, and how badly?
THE FLOW 1. Open a recommendation 2. Click "View Blast Radius" 3. The architecture canvas activates an overlay 4. A side panel reports stats, impact, ownership and risk factorsThe graph it walks
A SERVER-SIDE ADJACENCY GRAPH, built from resourcemetadata: shared security groups, routing targets,attachments, triggers, parentage.
It identifies ONE-HOP connected resources. Directneighbours only.The graph is held in memory and cached per organisation with a short TTL, invalidated when resources are discovered or deleted, so it reflects the estate as discovery last saw it rather than being rebuilt on every click.
Why one hop, and what that costs you
One hop is a deliberate scope, not an unfinished feature.
WHAT ONE HOP GIVES YOU The neighbours you can actually reason about. If you delete this volume, the instance it is attached to is a fact you can check.
WHAT IT MISSES The service two hops away that calls the service attached to this database. Blast radius will not tell you about it.The honest framing for a colleague: blast radius tells you what is directly connected, and it is your judgement that decides whether a directly-affected resource has consequences further out. It narrows the question; it does not answer it entirely.
Multi-hop traversal is explicitly not in v1, and the reason is legible: at two hops a moderately connected estate returns most of itself, and a result that highlights everything highlights nothing.
Safe must be proven
The classification default is the most important behavioural fact in this module.
DEFAULT = WARNING For ALL operations, including modify, on any resource type that is not explicitly mapped.
SAFE must be EXPLICITLY PROVEN, through the resource-typebehaviour map or the edge matrix.This is the same fail-closed posture as the Safety Gate (M2.3.L7). An unmapped resource type does not read as harmless; it reads as “we do not know”, and “we do not know” renders amber.
So a canvas full of amber on an unusual resource type is frequently a coverage statement rather than a genuine hazard. That is worth knowing before you interpret one as alarming.
Reading the canvas
BLUE the target: the resource the action applies toRED affected: this will be broken or destroyedAMBER warning: disrupted, degraded, or briefly offlineGREEN safe: proven not to be impactedDIMMED unrelated: not a neighbour of the targetThe dimming is what makes the overlay usable. A production canvas is dense, and the value is in collapsing it to the handful of nodes that matter for this one decision.
The side panel
STATS counts by severityIMPACT SUMMARY what happens, in proseRESOURCE DETAILS the affected neighbours, individuallyOWNERSHIP team, resource group, scheduleRISK FACTORS what drove the score (L3)The ownership block is the one people underuse. It tells you which teams and which schedules touch the affected set, which is usually the difference between “I can do this now” and “I need to tell two people first”. A resource that is safe technically and owned by another team is still a conversation.
Three entity types
resource v1. A single cloud resource targeted by a recommendation.
autoscaler_policy the policy's scaling target is treated as the blast-radius root, so applying, removing or tuning a policy surfaces the same connected set.
schedule a schedule update or delete triggers a confirmation dialog with a View Blast Radius link. Shows directly attached resources and expandable resource groups, with per-resource cost impact.The schedule case is worth calling out because it is the one most people meet first. Editing a schedule looks harmless, and it is the action with the widest reach in the product: one schedule can govern hundreds of resources across several groups.
2. Demo
Two blast radius checks on the same afternoon, with opposite outcomes:
CHECK 1: RC-002, delete an unattached EBS volume Target: vol-0f81c33a (blue) Neighbours: 1 i-0a3f9c2b1d GREEN, safe edge: attached_to, but the volume is unattached, so the edge is historical metadata
Risk score: 0 Side panel: nothing impacted, no ownership spread DECISION: applied immediately. This is what a genuinely safe action looks like, and the zero is meaningful because safe was proven rather than assumed.
CHECK 2: edit a schedule's stop cron Target: "non-prod-nightly" (blue) What the dialog showed BEFORE the canvas: directly attached resources 14 resource groups 3 (expandable) total resources behind them 186
Canvas, operation = modify: 186 nodes AMBER (warning) Ownership: 6 teams, 4 schedules
Cost impact, batched into the panel: monthly cost of the affected set $31,400 current savings from this schedule $9,100 savings after the edit $4,300
DECISION: not applied. The engineer was fixing a stop time for ONE service and had not registered that the schedule governed 186 resources across 6 teams.
WHAT THEY DID INSTEAD Detached their service from the shared schedule and gave it its own. Blast radius on the new schedule: 1 resource, 1 team, risk 0.
THE POINT Check 1 took four seconds and confirmed a safe action. Check 2 took thirty seconds and prevented halving the savings on a schedule six other teams depended on.3. Hands-on (6 min)
1. Open any orphan-category recommendation and click View Blast Radius. Neighbours found: ______ Colour distribution: red ___ amber ___ green ___ Risk score: ______
2. Open a schedule you did not create and look at its blast radius for a modify. Directly attached: ______ Resource groups: ______ Total resources behind them: ______ Were you surprised? Y / N
3. Find a canvas showing mostly AMBER. Check the resource types involved. Are they unusual types? Y / N If yes, you may be reading a coverage statement rather than a hazard. Note which types: ______________________________________________
4. On any result, read the OWNERSHIP block. How many teams other than yours appear? ______ Would you have known to tell them? Y / N
5. Name one thing two hops away that blast radius did NOT tell you about, and that you know from experience: ______________________________________________Step 5 is the discipline. The tool narrows the question; it does not close it.
Ask for it instead. The same task you just did in the console, asked in one sentence.
BEFORE A ZopNight account with one cloud connected. One resource with dependents: a database behind an app tier, or a load balancer in front of one.ASK "What is the blast radius of stopping this resource, and is it eligible?"CHECK the edges it reports. The limits in L4 are real: an edge it cannot see is still an edge.Tools behind it: get_blast_radius (read, Explore), check_eligibility (read, Introspect), preview_remediation (read, Optimize). The full catalogue is at zop.dev/learn/mcp-tools.
4. Knowledge check
Q1
Blast radius traverses one hop only. This is:
A. An unfinished feature awaiting multi-hop support
B. A deliberate scope. Multi-hop is explicitly out of v1
C. A performance limitation of the adjacency graph
D. A limitation of the canvas rendering
Show answer
Correct: B. One hop returns neighbours you can actually reason about; at two hops a moderately connected estate returns most of itself, and a result that highlights everything highlights nothing. The honest framing is that blast radius tells you what is directly connected, and your judgement decides whether a directly-affected resource has consequences further out. It narrows the question rather than closing it.
Q2
A blast radius result shows a canvas full of amber for a modify operation on an unusual resource type. The most likely reading:
A. The action is genuinely hazardous
B. The resource is in production
C. The adjacency graph is stale
D. A coverage statement
Show answer
Correct: D. The classification default is Warning for all operations, including modify, on any resource type not explicitly mapped, because Safe must be explicitly proven through the behaviour map or the edge matrix. Amber can mean “we do not know” rather than “this will break”. This is the same fail-closed posture as the Safety Gate: an unmapped type does not read as harmless. Knowing it prevents both over-reacting to amber and, more importantly, mistaking amber for a proven risk assessment.
Q3
Which entity types can be a blast radius root?
A. Resources only
B. Any entity with a UID
C. A resource, an autoscaler policy (whose scaling target becomes the root) and a schedule (which shows directly attached resources plus expandable resource groups with per-resource cost impact)
D. Resources and resource groups only, plus schedules, since a schedule is what actually causes the change and therefore what the blast radius is really being computed against in the first place
Show answer
Correct: C. Teams, resource groups and cloud accounts are not supported roots in v1. The schedule case is the one most people meet first and the one with the widest reach: editing a schedule looks harmless, and a single schedule can govern hundreds of resources across several groups and teams.
5. Apply
Make blast radius a habit on two actions specifically: any delete, and any edit to a schedule you did not create. Those are the two where the gap between what the action looks like and what it reaches is widest.
Read the ownership block every time, even when the risk score is low. Technically safe and owned by another team is still a conversation you want to have before rather than after.
Related lessons
- L2: Impact classification (next)
- L3: The risk score
- T2.M2.3.L7: The Recommendation Safety Gate
- T5.M5.6.L4: Blast radius in IaC: import, move, destroy
Glossary terms touched
Blast radius · Adjacency graph · One-hop traversal · Canvas overlay