Blast-Radius Code Review
Blast-Radius Code Review
Scale human review effort to how much damage a change could do, not to how much code there is. Coined for the vault from John Kim's "code base as a tree" framing in How I Review AI Code (John Kim).
The model
| Trunk code | Leaf code | |
|---|---|---|
| What | Entry points, shared state (reducers), core infra (rendering, networking), anything with many downstream dependents | Isolated components, new endpoints/logic not yet integrated, anything fully behind a feature gate |
| Failure mode | Breaks production broadly; side effects travel | Contained; can be switched off |
| Human review | Read closely | Skim for anything obviously wrong |
| Proof that substitutes for reading | — (proof still required, but doesn't replace reading) | Component/snapshot/unit/integration tests, screenshots, runtime logs |
The dial is set by three questions: what control experience must not change? how bad is failure? can I roll it back? Reversibility is the lever — feature gating turns trunk-adjacent changes into leaf-like ones, which is why gating belongs in the plan, not bolted on at launch. One-way doors always get deep review.
Why it matters
The Verification Tax says AI output outruns human review capacity. Blast-radius review is the allocation answer: don't pay the tax uniformly, spend scarce human attention where a mistake is expensive and irreversible, and let agent-produced evidence (see LLM as Judge, skill-embedded verification in What to Build Instead of AI Agents (Nate Herk)) cover the rest. It is the code-review form of Bounded vs Unbounded Tasks-style risk tiering — the same logic enterprises apply to change management (standard vs normal vs emergency changes), applied per diff.
Leadership read: a team claiming "we review everything" at agentic volume is either slow or not really reviewing. The better question for an engineering org is whether it can classify changes by blast radius and whether its gating/rollback infrastructure is good enough to make most changes leaf-like.
Limits
Single practitioner source so far; no data on defect escape rates under tiered review. Classifying trunk vs leaf needs someone who knows the code base — the approach weakens exactly where Cognitive Debt is high.