Blast radius
Blast radius is how much an automated action can affect if it is wrong: one host or the whole estate, one session or every user. Good controls cap it with scope limits, count caps and approvals. A vendor page that never mentions scope leaves the buyer to discover it in production.
Definition
Ask what the largest single action is. Isolating one laptop is small. Disabling a service account that runs payments is not. Ask whether the platform can refuse an action above a set size.
Scope can be set by role and permission, by count per hour, by asset tag or by approval tier. The rubric asks for a documented scope limit, not just a promise of care.
Blast radius in Microsoft Sentinel's documentation
Microsoft Sentinel's documentation says running a playbook from an automation rule needs the Microsoft Sentinel Automation Contributor role on the playbook's resource group, so the role bounds which playbooks a rule can run. vendor claim learn.microsoft.com, read
The example names a vendor and its own page. A vendor's use of Blast radius may differ from the definition above; the rubric uses the definition on this page.