AI Agent Blast Radius & Guardrail Policy Simulator
Before an AI agent touches production Salesforce data, dry-run it here. Drop a Describe payload, dial in the action, and get a Blast Radius score, an Irreversibility Index, and a guardrail policy you can hand straight to Agentforce, LangChain, or a system prompt — every calculation stays in this browser tab.
1. Describe payload
Drop a Salesforce SObject Describe JSON (or paste one below). Parsed entirely in your browser — nothing is uploaded.
Drop a Describe JSON file here, or click to browse.
Or paste JSON directly
No object loaded yet — load a Describe payload to begin.
2. Agent action
What is the agent about to do, and how?
Records touched in a single execution.
This action triggers external side effects
Outbound webhooks, emails, or third-party API calls fired as a result — these can't be undone by rolling back the record.
Live Salesforce connector Coming soon
Module D — pulling Describe metadata directly from a Salesforce org via OAuth 2.0 PKCE — needs a registered Connected App (a real Client ID and callback URL) before it can run for real. Rather than fake it, it's disabled until that's set up. Everything above works fully offline with a Describe payload you already have.
Impact analysis
Load a payload and set the action above — this updates instantly as you change anything.
LOW RISK — no additional guardrails required
0
Blast Radius (0–100)
0%
Irreversibility Index
NOT REQUIRED
Human Approval Status
Guardrail policy export
Machine-readable output, generated live from the metrics above.
Copied!
Load a payload to generate a policy.
Privacy & methodology
Agent-Impact is a static, client-side simulator. There is no backend for it to call.
What happens to what you drop in
The Describe payload you drop or paste is parsed entirely in this browser tab, in memory. It is never uploaded, logged, or sent anywhere.
Nothing is written to disk or to any server. Refreshing the page clears everything.
Opening this page and dropping a local JSON file will show zero outbound network requests in DevTools' Network tab.
Read-only, opt-in scope only
The optional live Salesforce connector (not yet enabled — see the panel on the page) would request only the id and api OAuth scopes and only ever call read-only Describe/Tooling endpoints. It would never write to your org.
What the scores mean
Blast Radius, Irreversibility, and the resulting risk tier are heuristic estimates built from your inputs and generic, publicly documented Salesforce metadata concepts (cascade-delete relationships, record-triggered flows, bulk API batching). They're a starting point for a guardrail conversation, not a certified risk assessment, and not derived from any employer's internal systems or proprietary data.
Independent project
This is an independent tool built by Kris McCabe on his own time. It isn't affiliated with, endorsed by, or built using confidential material from Salesforce, Anthropic, or any employer, past or present.