Agent Kill Switch and Emergency Stop
Added Invalid Date
Maintain an immediate stop for any agent session, workflow, or type of agent. It must work without agent cooperation and support recovery to a known-safe state.
Objective
Preserve human control over agents while they are running by ensuring a reliable, tested mechanism exists to stop agents that are behaving unexpectedly, consuming excessive resources, or taking unauthorized actions.
Maturity Levels
Initial
No kill mechanism exists; stopping a runaway agent requires manually shutting down the underlying servers, which takes significant time.
Developing
Shutting down the underlying servers is possible but requires engineers' access and is not documented or tested.
Defined
A documented stop procedure exists for each agent class with named responsible parties; procedures are known to the on-call team.
Managed
Stop procedures are tested quarterly; recovery to known-safe state is verified after each test; response time targets are met.
Optimizing
Automated circuit breakers (safeguards that trip on their own) pause agents when their behavior crosses set limits; human-triggered stop is a single, audited action available to designated operators 24/7.
Evidence Requirements
What an auditor or assessor would expect to see for this control.
- —Stop procedure documentation covering individual session, agent class, and full deployment scopes, with named responsible parties, trigger criteria, and target response times
- —Quarterly stop procedure test records showing time-to-stop for each scope and verification that recovery to known-safe state succeeded
- —Authority matrix confirming who can trigger each stop scope and under what conditions, without requiring additional approval
- —Partial-completion recovery playbook documenting how work left half-done is assessed and handled after an emergency stop
- —On-call contact list for stop-authorized personnel reviewed and updated at least quarterly, with evidence of last review
Implementation Notes
Key steps
- Build the ability to stop into agents from the design stage: every system that runs an agent must support ending a session immediately, without waiting for the agent to reach a natural stopping point.
- Define three stop scopes and document each separately: (1) individual session termination, (2) agent class pause (all instances of one agent type), and (3) full deployment suspension.
- Assign explicit stop authority: who can trigger each scope, under what conditions, and without requiring additional approval, ambiguity in a crisis costs time.
- Test stop procedures on a schedule and document the result: an untested kill switch (emergency stop) is not a kill switch.
- Plan for half-finished work before you need to: if an agent is stopped mid-workflow, what data was written, what outside systems were contacted, and how do you recover or roll back to a safe state?
Example Implementation
Healthcare organization running scheduling and medical records agents over patient data
Agent Emergency Stop Runbook: Healthcare Agent Platform
Stop scope levels:
| Scope | Trigger Criteria | Stop Authority | Target Response | Method |
|---|---|---|---|---|
| Session stop | Single agent behaving unexpectedly | Any authorized operator | <60 seconds | Session termination API; session flagged in audit log |
| Agent class pause | Pattern of anomalies across agent type | AI Eng lead or on-call | <5 minutes | Feature flag disable; queued sessions rejected |
| Full deployment stop | Active patient harm or data breach | CISO or designee | <15 minutes | Infrastructure shutdown; incident declared |
On-call stop authority: AI Eng on-call + CISO (or delegate), contacts reviewed monthly
Partial-completion recovery:
- Any session terminated mid-workflow: state snapshot written before termination; human reviewer notified within 15 minutes to assess and complete manually if needed
- No external write (EHR update, message send) confirmed without human verification after emergency stop
Test cadence: Quarterly, session stop tested monthly; class pause and full stop tested quarterly; results logged and signed off by AI Governance lead