Module blast_radius

Blast-radius analysis: classify decision changes across a replay corpus.

A blast-radius analysis replays a corpus of past authorization requests against both the old and the new policy bundle, then classifies each request as Unchanged, AllowToDeny (the dangerous direction), DenyToAllow (often a bug), or Other (transitions between Deny and an error state, etc.).

Complexity: O(N × P) where N = replay corpus size, P = policy set size. The Authorizer for each bundle is constructed once and reused across the corpus, so the dominant cost is O(N) cedar policy evaluations.

Structs

BlastRadiusReport

Aggregate blast-radius report.

ReplayRequest

A replay request — a serialized agentguard_core::AgentRequest plus the entities that should be loaded with it.

Enums

ChangeClass

Classification of how a single replay request’s decision changed.

Functions

analyze

Replay the corpus against both bundles and classify the changes.