The Blast Radius Classifier for Every Change

Every change should be classified by blast radius before it ships. The five-tier classifier and the gates each tier triggers.

The five tiers

The classifier scales gates with blast radius. The bigger the blast, the heavier the gates; small changes ship fast, big changes ship carefully.

• T0: dev-only. No customer impact, no gates beyond local CI; engineers ship at will.
• T1: internal users. Light gates: PR review; deploy any time.
• T2: opt-in customers. Full gates: PR review, eval suite, canary; deploy in business hours.
• T3: all customers, single region. Heavy gates: T2 plus on-call awareness, named deploy window, automated rollback ready.
• T4: all customers, all regions. Critical gates: T3 plus leadership awareness, two-person approval, multi-day soak.

How to apply

The classifier only works if it is applied at PR time, not at deploy time. The author classifies; the reviewer verifies; the gates flow from the tier.

• Author classifies. Single field on the PR template; the author commits to a tier before requesting review.
• Reviewer verifies. Reviewer either confirms or escalates; disagreements bubble to a tech lead, not a slack debate.
• Misclassification. Treated as a postmortem item; severe misclassification (T4 shipped as T1) is a major incident on its own.
• Calibration. Monthly review of last month's tiering against actual incidents; tune the rubric where the data disagrees.

Avoid

Three failure modes erode the classifier into theatre. Watch for them in retros and shut them down early.

• Tier inflation. Marking everything T2 to look careful; defeats the system, gates lose meaning.
• Tier deflation. Marking T4 as T2 because the author 'knows' it is safe; the classifier is for the team, not the individual.
• Skipping on urgent. Urgent changes are exactly when the classifier is most useful; the rule applies hardest under pressure.
• Drift. Tiers stop meaning anything if the rubric is not refreshed; an annual rewrite keeps it sharp.