A useful kill switch removes the narrowest dangerous capability quickly. A single global off button is too disruptive for routine containment and may destroy evidence or leave partial side effects.
Layered controls
- Disable one agent or workflow version.
- Deny a tool action while leaving read operations available.
- Quarantine a connection or rotate its credential.
- Block a model/provider route or fallback.
- Pause triggers, queues, retries, or one tenant.
- Enter read-only or approval-required mode.
Switch contract
Every control needs an owner, authorization rule, target scope, propagation objective, fail state, evidence event, affected-session query, rollback procedure, and recovery approver. The model must not be able to override it through instructions.
Test it
Activate each switch during queued, running, retrying, and approval-wait states. Verify new execution stops, in-flight side effects reconcile, credentials revoke, evidence remains queryable, dependencies do not silently reroute, and restoration requires an explicit decision.