> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/harness-platform/use-harness-platform/governance/policy-as-code/blast-radius-analysis.md). # Blast radius analysis for policies Estimate the impact of a Harness policy change before you save it by replaying the policy against recent evaluations. {% hint style="info" %} This feature is in Beta[^1] and requires enablement. [View all early access features.](/release-notes/features.md) {% @harness-feature-flag-access/request-feature-flag-access module="platform" pagePath="platform/use-harness-platform/governance/policy-as-code/blast-radius-analysis" featureFlags="%5B%7B%22name%22%3A%22Blast%20radius%20analysis%20for%20policies%22%2C%22key%22%3A%22OPA\_BLAST\_RADIUS%22%2C%22status%22%3A%22BETA%22%2C%22description%22%3A%22Adds%20the%20Blast%20Radius%20Analysis%20tab%20to%20the%20policy%20editor%20so%20you%20can%20estimate%20the%20impact%20of%20a%20policy%20on%20recent%20evaluations.%22%7D%5D" %} {% endhint %} When you change a Rego policy, the new version applies to the next evaluation of every policy set that includes it. Blast radius analysis shows which entities the change would affect before that happens. It replays your policy against recent evaluations, so you can see which entities would pass and which would fail. *** ## What you will learn from this topic * How to [run a blast radius analysis](#run-a-blast-radius-analysis) on a saved or unsaved policy. * How to [configure the analysis scope](#configure-the-analysis-scope) by project, entity type, and action. * How Harness [selects the evaluations](#evaluation-selection-criteria) it replays. * How to [read the results](#read-the-results). *** ## Before you begin Before you run a blast radius analysis, ensure you have: * **A policy**: A new policy or an existing policy at the account, organization, or project scope. Go to [Harness Policy As Code overview](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-overview.md#harness-policies) to create one. * **Policy permissions**: The permissions to view and edit policies at the scope where you open the policy. Go to [RBAC in Harness](/harness-platform/3.0/harness-platform-resources/platform-access-control/rbac-in-harness.md) to review roles and permissions. * **Evaluation history**: Recent evaluations for the entity type you want to analyze. Without history, Harness uses built-in sample payloads. Go to [Policy evaluations retention](/harness-platform/use-harness-platform/governance/policy-as-code/opa-evaluations-retention.md) to learn how long evaluations are kept. *** ## Run a blast radius analysis You can run the analysis while you create a new policy, while you edit a policy before you save it, or on a policy that is already saved. 1. In Harness, go to **Account Settings**, **Organization Settings**, or **Project Settings**, and select **Policies**. Create a policy, or open an existing one. 2. Write or edit the Rego in the **Studio** tab. You do not have to save the policy or the change. 3. Select the **Blast Radius Analysis** tab. 4. Click **Configure** to set the scope, or keep the default scope. Go to [Configure the analysis scope](#configure-the-analysis-scope) for the options. 5. Click **Calculate**. ![The Blast Radius Analysis tab in the policy editor, showing the current scope and the Calculate button.](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-9e04c318f480924042a470ac7d37598982b19d6c%2Fopa-blast-radius-tab.png?alt=media) Harness runs the policy as it currently appears in the editor against the selected evaluations and shows the results on the page. {% hint style="info" %} **Dry run evaluations are not stored** The evaluations that Harness runs for a blast radius analysis do not appear in the **Evaluations** tab. The analysis runs each time you click **Calculate**, and Harness does not keep the results. Payloads that you test in the Testing Terminal are not stored either. {% endhint %} *** ## Configure the analysis scope The scope bar on the **Blast Radius Analysis** tab shows the organization, project, entity type, and action that Harness uses. Click **Configure** to open the **Configure analysis scope** panel, change the values, and click **Apply**. ![The Configure analysis scope panel with Organization, Project, Entity type, and Action fields.](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-429d608ead481ab5747386e5089a9aa4e7ee47bb%2Fopa-blast-radius-configure-scope.png?alt=media) The panel has the following fields: | Field | Description | | ---------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Organization** | Limits the analysis to evaluations of entities in this organization. The default is **All organizations** at the account scope. At the organization and project scopes, Harness fixes the value to the current organization. | | **Project** | Limits the analysis to evaluations of entities in this project. The default is **All projects**. At the project scope, Harness fixes the value to the current project. At the account scope, select an organization first to enable this field. | | **Entity type** | Required. The type of entity to replay evaluations for, such as **Pipeline**. The list contains the entity types that policy sets support. | | **Action** | The event to replay evaluations for. The default is **All actions**. The list contains the actions that apply to the selected entity type, such as **On Run**, **On Save**, and **On Step Start** for a pipeline. | *** ## Evaluation selection criteria When you click **Calculate**, Harness looks at the previous evaluations that match the entity type and action you selected, and applies the following limits: * **Time window**: Harness considers evaluations from the last 30 days. * **Entity limit**: Harness replays up to 25 unique entities. For the **Terraform Plan** and **Terraform State** entity types, the limit is 10 unique entities. If an entity was evaluated multiple times, Harness uses only its most recent evaluation. * **Payload size**: The maximum payload size is 30 MB. Harness skips and rejects any payload larger than 30 MB. For example, if only 10 unique pipelines were evaluated in the last 30 days, Harness replays the policy against those 10 pipelines. If there are no previous evaluations for the entity type and action, Harness replays the policy against the built-in sample payloads for that entity type. If you change the policy or the scope after you calculate, the page shows a warning that the results are out of date. Click **Calculate** again to re-evaluate. *** ## Read the results The results show two totals followed by a list of the entities that Harness evaluated: * **Errors**: The number of policy violations, which are the entities that fail the policy. * **Passes**: The number of compliant entities. Each entry in the list shows whether the entity passes or fails, the entity name, and a badge that shows where the payload came from: * **History**: The payload comes from a previous evaluation in the selected scope. * **Sample payload**: There is no history for the entity type and action, so Harness uses a built-in sample payload. Expand an entry to see the details: * For an entity that fails, Harness displays the failure message returned by the policy. For a **History** entry, it also shows a **View evaluation** link. * For an entity that passes, Harness shows that no deny rules matched the entity. ### Results from past evaluations The following example shows two entities that fail the policy. Both entries have the **History** badge and are expanded. ![Blast Radius Analysis results showing two policy violations from past evaluations, each with a failure message and a View evaluation link.](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-9c46dab81798090eb57895358ad279d36e5944d7%2Fopa-blast-radius-results-history.png?alt=media) The **View evaluation** link opens the previous evaluation that Harness replayed. Open it to see the payload that the policy ran against. The link opens the original evaluation, not the dry run. ### Results from sample payloads The following example shows an entity that Harness evaluated with a built-in sample payload because there was no history to replay. ![Blast Radius Analysis results showing one policy violation evaluated with a sample payload.](https://173309742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3F2TpHXhur2QtQnORSM9%2Fuploads%2Fgit-blob-117e55930b3cfc6657b8146a257ce69a2c30059f%2Fopa-blast-radius-results-sample-payload.png?alt=media) *** ## Next steps * Go to [Testing terminal](/harness-platform/use-harness-platform/governance/policy-as-code/harness-governance-overview.md#testing-terminal) to test a policy against a single input payload. * Go to [Policy evaluations retention](/harness-platform/use-harness-platform/governance/policy-as-code/opa-evaluations-retention.md) to learn how long Harness keeps the evaluations that the analysis replays. {% @harness-feedback/feedback module="harness-ai" pagePath="harness-ai/use-harness-platform/governance/policy-as-code/blast-radius-analysis" %} [^1]: Off by default. If you want to try it and share feedback, request access and Harness will turn it on for your account. Beta features can change and may not be ready for production use.