blast radius
Everything an attacker can reach once one device or credential is compromised.
The blast radius of a credential or device is the set of data, topics and systems an attacker gains by compromising it; least privilege and segmentation keep it small.
Examples
If bench node gh-a1's credential may publish to any
gh1/...topic, stealing it lets an attacker fake every bench's readings and fan commands: a large blast radius.Scoped to
gh1/gh-a1/telemetry/#andgh1/gh-a1/status, the same stolen credential can only lie about one bench.