AI Agent Kill Switch: A Self-Check for Stop, Containment and Rollback

An agent is mid-run and doing the wrong thing. You have one minute. Which control do you reach for, who is allowed to use it, and does the agent have any way to interfere with it? A team that cannot answer all three has an off switch only on paper.

The check below treats a kill switch as three separate abilities. Stop means no new actions start. Contain means nothing stays reachable even if a process keeps running. Roll back means the damage already done gets undone or repaired. Eight questions follow, worth 0, 1 or 2 points each. Give the top mark only against a drill record, a config or a log. A high total is not a guarantee of safety.

The eight-question stop, contain and undo sheet

Check	Nothing (0)	Some (1)	Proven (2)
1. Does the halt command sit in a component the agent has no rights to modify, such as a gateway, scheduler or orchestrator?	The agent itself must cooperate	Mixed	Architecture notes and config confirm an external layer
2. Does each agent authenticate as itself?	A single shared account	Some share	The identity provider shows one principal per agent
3. How long passes between revoking access and the final accepted request?	Unknown	Guessed	Timed during a drill, figure on file
4. Are graded responses defined (pause, read-only, drop one tool, total shutdown), each with a person responsible?	One big red button, or nothing	Grades without names	Grades and names documented, reachable at 3 a.m.
5. Is there an undo step for every tool that writes?	No undo steps	A few	Each write tool has a documented reversal
6. Can someone see pending outbound effects (mail, jobs, requests) and cancel them together?	Pending work is invisible	Visible, cancelled one at a time	Mass cancel exercised
7. Do records stored away from the agent capture who acted, with which tool, on what, and the outcome?	Only the agent's own logs	Gaps in the record	Full external record, read during a drill
8. Within the last three months, did you rehearse halting, isolating and reversing, with times saved?	No rehearsal	Halting only	All three, timings archived

Interpreting the total

• 0 to 5, a hope. Everyone assumes the agent can be halted, but no one has seen it happen.
• 6 to 11, stoppable but not repairable. Halting works for most agents, while repair is slow and improvised.
• 12 to 16, rehearsed. You hold times on paper. The risk now is drift as tools change.

These bands are an editorial rule of thumb, not part of any published standard.

Three cheap improvements per band

Low band

1. Place a gate ahead of the tools, for instance a flag read before each call, and deny the agent any write access to that flag.
2. Issue a separate short-lived credential to each agent. A revoked credential is a settled fact, whereas a stop signal to a process is only a polite request.
3. Decide who can act overnight, and remove any need for a second signature.

Middle band

1. Time a revocation in rehearsal, since a cached session may outlast the revoke command.
2. Document an undo for each writing tool and stamp every action with a run identifier, so the work to reverse is easy to find.
3. Stage irreversible actions as drafts behind a policy or human gate. See human oversight in production for keeping that gate meaningful.

High band

1. Rerun the rehearsal whenever the tool list changes.
2. Plant test records, roll back, and diff the result against the state you expected.
3. Check that the records answer what an investigator would ask. The incident response guide picks up after the stop.

Where each question comes from

The MANAGE section of the NIST AI RMF Playbook pairs a working mechanism with a named responsible party for overriding or deactivating a system (NIST AI RMF Playbook). Questions 1 and 4 mirror that pair. In practice the mechanism gets built and the owner gets forgotten.

For high-risk systems under the EU AI Act, Article 14 on human oversight asks that a person be able to intervene or interrupt the system through a stop button or similar procedure that brings it to a halt in a safe state (Article 14 text). Whether your agent counts as high-risk is a question for legal counsel, not something this sheet decides.

OWASP's entry on excessive agency lists three causes: too much functionality, too many permissions and too much autonomy (OWASP LLM06:2025). Because the switch is your fallback when those fail, it cannot rely on them. Hence an external layer in question 1 and per-agent identity in question 2. Identity design is covered in our non-human identity article.

Three and eight are editorial judgement, since an untried switch is only a belief. Five to seven come from the way agents depart from normal services. Killing a process does not recall a queued email or a half-open pull request, so you need to see the queue and read logs the agent cannot write.

Revoke credentials before you kill processes

Most teams reach for the process first: kill the pod, pause the job. That is the wrong default, and the reason is timing. A process can be restarted by a supervisor, and a copy may already be running elsewhere. A revoked credential makes every copy useless at the same moment.

Even revocation has delay, so measure it. AWS documents that it can attach a policy denying all role sessions issued before a chosen time, and that the cut-off includes roughly thirty seconds into the future to allow for propagation (AWS IAM, revoking role sessions). Sessions that began after that moment are not affected. Whatever platform you use, find the equivalent behaviour and time it before the night you need it.

The position taken here: credential revocation is the primary stop, and process control is the tidy-up. Attach a name and an owner to it, because a mechanism nobody may press protects nobody.

The advice changes for an agent holding no credentials of its own, such as a purely local assistant with a read-only sandbox. There, killing the process is the whole stop. The advice also weakens where the effects live in systems you do not control. A sent message cannot be recalled by revoking anything, which is why question 5 exists and why irreversible actions deserve a staged draft.

Running the drill

Choose a low-risk agent and tell whoever is on call just that a stop test is coming. Run a stopwatch and note four moments: first notice, choice of response grade, last accepted request, and the point where the repaired state matched expectations. Those timings are your honest answers to the third, fourth and eighth checks. Circulate them to the agent owners.

Pair the drill with monitoring that can see the trigger in the first place. What to log, measure and alert on lists the signals worth wiring up.

Limits of this check

A strong total shows the paths held in one rehearsal. It says nothing about every possible failure or about systems beyond your reach, and certain effects can never be reversed. Treat the sheet as a readiness check and not as an audit. Production decisions belong with qualified security staff.

Kill switch questions answered