Blast radius, applied to a directory, is the complete set of consequences a change would produce: every user who gains access, every user who loses it, and every license assignment that cascades either way. It is the number you need before a change, and the one nothing native computes.
Why directory blast radius surprises people#
Transitive membership means consequences travel: a change to one group propagates through every chain that passes through it. The person making the change sees one edge; the directory applies the closure. The gap between those two views is the entire category of after-the-restructure incidents.
Computing it#
Blast radius is computable before acting: expand the transitive membership affected by the change, intersect with access and license grants along the affected paths, and difference the before and after states. Doing that by hand per planned change is exactly the work that does not happen under deadline pressure, which is why it belongs in tooling.
VisualizerEngine
Blast radius in VisualizerEngine
Every what-if simulation shows the full blast radius: who gains access, who loses it, which licenses cascade, across multi-step scenarios compared side by side, with an ordered implementation plan generated at the end. The computation happens against the mirror, never against your live directory.