Agent kill switch

An agent kill switch is the control an operator uses to stop an AI agent quickly and completely. One command should cancel the agent's active runs, refuse any further action it proposes, revoke the credentials it uses, and record what each part of the system did in response. The term covers a sequence of controls, and a single toggle rarely covers all of them.

The EU AI Act states the requirement for high-risk AI systems in Article 14(4)(e): the people assigned to human oversight must be able "to intervene in the operation of the high-risk AI system or interrupt the system through a 'stop' button or a similar procedure that allows the system to come to a halt in a safe state." For an agent, a safe state means no half-finished side effects: a payment is either sent or not sent, and the record says which.

A kill switch has to act at several points, because an agent can be partway through a task when the command arrives. Runtime cancellation stops the workflow before its next step. Pre-execution denial refuses every proposed tool call from the affected scope. Credential revocation disables the agent identity and its tokens so that no other path stays open. Evidence records the time of the command, which controls acknowledged it, and the last side effect that completed before the stop.

A kill switch cannot undo an action that has already completed in an external system. A sent email or a settled transfer needs its own compensating action. Test the switch in drills, measure the time from command to last refused action, and define who may restore the agent and on what conditions. In our own development environment, an early version of the freeze command failed with an unexplained error because the incident that triggered it carried a run identifier with no agent attached. The command now resolves the agent from the run and returns a clear error when it cannot. Run the drill from every kind of trigger an operator might use.

In KLA Control Plane, the cancellation API sends a kill signal to a tenant-scoped execution in PENDING, RUNNING or GATED state and records it as CANCELLED. The workflow checks the signal before starting its next step, and a run waiting on a Decision Request exits without resuming the proposed action.