Glossary
Blast radius
How much breaks when one thing goes wrong. Good design keeps it small, so a single failure affects one region, customer or feature rather than everything.
In plain terms
Every system eventually fails somewhere. The design question is how far the failure spreads. Cells, regions, staged rollouts and separate credentials are all ways to shrink the blast radius.
Global configuration is where blast radius tends to be largest, because one file read by every server can take them all down at once.
See what happens without it
The failure pattern this protects against, global change without a staged rollout, played out step by step.
Scroll the diagram sideways to see every system.
One mistake, one global outage.
What goes wrong:
- A configuration file with one bad value is published.
- Within seconds it reaches every server in the world.
- Every server fails on the same input at the same time.
- One mistake, one global outage.
With the safeguard:
- A configuration file with one bad value is published.
- It goes to a small canary group first, not everywhere.
- Health checks catch the errors and roll back automatically.
- The rest of the world never sees the bad value.
When it mattered
In 2025 a policy change with blank fields crashed Google Cloud’s Service Control in every region, because the bad data replicated globally within seconds.