Every production agent needs a way to stop — not a dashboard to watch it fail, a control that ends its ability to act. That control is the kill switch, and most of the engineering is in one question: where it sits.
The short answer
An agent kill switch is a single, immediately reachable control that blocks all future mediated actions for an agent — every tool call, model call, and API request it attempts is refused from that moment. It must sit in the call path (in the gateway or proxy every call passes through), because a switch anywhere else — a config flag the agent reads when it feels like it, a console three logins deep — is a request, not a stop. It cannot undo actions that already completed, which is why it pairs with per-call authorization: prevention upstream, the switch for everything already moving.
Where it must sit, and why
In the path, not beside it. If the agent's calls pass through an authorizing gateway, flipping the switch changes what the gateway allows — the agent does not get a vote. If the "switch" is an environment variable, a database flag the framework checks between steps, or a revoke-the-key procedure, a looping or compromised agent may never observe it. Enforcement that depends on the agent's cooperation is decoration.
Reachable in seconds. The switch fires during incidents, by whoever is on call, possibly from a phone. Our kill switches essay makes the operational case; the architectural version is: if stopping the agent takes longer than the agent takes to spend real money, the switch is in the wrong place.
Scoped. Useful switches exist at three scopes — per agent (stop this one), per tool or provider (stop the bleeding edge), and fleet-wide (stop everything) — and the incident decides which. A single global switch teaches teams to hesitate; hesitation is how a $47,000 loop happens.
What a kill switch cannot do
- Undo completed actions. Sent email stays sent; executed trades stay executed. The switch bounds the future, which is why per-call policy and approval queues guard the actions that cannot be taken back.
- Reach unmediated calls. Calls the agent makes outside the gateway — a second key, a direct SDK path — bypass it. The switch is only as complete as the mediation; route everything, or the switch covers a subset and says nothing about it.
- Replace the refusal points. A switch is a human-speed control. The machine-speed controls — per-agent ceilings, iteration budgets, anomaly lockdown — are what fire at 3 a.m. before a human wakes. See the runaway loop checklist.
Kill switch vs pause vs revoke
A pause queues work for later resumption — right for maintenance, wrong for incidents, because the queue drains when it lifts. Revoking credentials works but is slow, blunt, and breaks every legitimate integration sharing the key — it is the manual version of the switch, with worse ergonomics. The switch is the designed control: instant, scoped, reversible when the incident closes, and logged like everything else the gateway mediates.