Step 1 of 4
Define detection and the kill switch
You cannot respond to what you cannot detect or stop.
Build detection and the emergency stop. DETECTION: enumerate mishap signals - blast-radius limits tripping, security events (blocked/escalated actions spiking), anomaly flags from observability (runaway cost, error bursts), audit-trail alerts on sensitive-resource changes, and human reports; define where each surfaces and who is notified. KILL SWITCH: implement a single, fast action that immediately halts the agent loop (no more turns), cancels in-flight tool executions at safe boundaries, and revokes the agent's tool authority (all tools drop to blocked/ask) - reachable by an operator without a code change and, ideally, auto-triggerable by severe signals (e.g. blast-radius hard stop). Test the kill switch: trigger it mid-task and confirm the agent stops acting within seconds and cannot execute further tools.
Expected after this step
Detection signals wired and a fast, tested kill switch.
Should not happen
- ✕No kill switch, so a misbehaving agent keeps acting while you scramble
- ✕Improvised response that makes things worse (deleting evidence, partial rollback)
- ✕Investigations that cannot reconstruct what happened for lack of records
- ✕Postmortems that assign blame and change nothing structural
Verify before continuing
Do not move on until every check is true. The complete button stays locked until then.
Do not continue if…
- !No kill switch, so a misbehaving agent keeps acting while you scramble
- !Improvised response that makes things worse (deleting evidence, partial rollback)
- !Investigations that cannot reconstruct what happened for lack of records
- !Postmortems that assign blame and change nothing structural
If the AI messes this up
Use this when the AI fakes progress or breaks the feature. It forces a real fix.
The kill switch leaves in-flight actions running. It must cancel at the next safe boundary AND revoke authority so queued/next calls are blocked - stopping new turns is not enough if a destructive call is already dispatched.