What Is an AI Agent Kill Switch? (And the Drill That Tests One)
An AI agent kill switch is a tested control that stops an agent from taking further actions — including work already in flight — while preserving a complete record of everything it did. A real kill switch is not a "disable" button: it must halt new and in-flight actions, survive the agent's own code, and produce an auditable list of what the agent wrote before it was stopped.
The five-step kill-switch drill
1. Stop new actions
Revoke or disable the agent's credentials, or block it at the gateway. Do not rely on the agent's own code to stop itself. Probe: send one tool call as the agent after the stop — pass means the call is denied and logged with the agent's identity and time.
2. Stop work already in flight
Drain or cancel queued jobs, scheduled runs and automatic retries. Probe: two minutes after the stop, query for any action by this agent with a later timestamp — pass means zero actions. A retry that fires after the stop is a fail.
3. List everything it did
Pull every write action (create, update, send, pay, delete) by this agent in the window you care about. Probe: time how long a complete list takes, with the system changed, record ID, and before/after values — pass is under ten minutes without hand-grepping logs.
4. Decide what to undo
Mark each write as: keep, roll back automatically, or hand to a named person. Probe: pick two writes and reverse them in a test environment — pass means each write has a rollback path or a named human owner. "We would figure it out" is a fail.
5. Restart under approval
A named approver — different from the person who stopped the agent — reviews steps 1 to 4 and signs off before credentials are restored. Probe: try to restart without the approval — pass means restart is blocked until the approval is recorded.
Where the kill switch fits
Risk and control framework
The kill switch is one of six control layers. See the full framework: identity, permission scope, runtime policy, approvals, evidence, inventory.
Stop conditions in practice
How remediation agents decide when to stop themselves — and why self-stopping is not a kill switch.
Score your readiness
36 checks including the kill-switch drill. Free, no signup.
Frequently asked questions
What is an AI agent kill switch?
A kill switch is a control that stops an autonomous agent from taking further actions and proves it stopped. It has four properties: it halts new actions, it halts work already in flight (queued jobs, retries, scheduled runs), it does not depend on the agent's own code obeying, and it leaves an auditable record of everything the agent did before the stop. A deployment rollback is not a kill switch — it changes code, but it does not stop an agent mid-run or account for its actions.
How is a kill switch different from disabling an agent?
A "disable" button is untested and often incomplete. The test is a drill: press the control and start a timer. Can you prove no action occurred after the stop decision? Can you produce a complete list of what the agent wrote, in minutes? Does every write have a rollback path or a named human owner? Does restart require a different person's approval? Teams that only have a disable button usually fail the in-flight and evidence steps.
Who should be able to trigger the kill switch?
A role on call — not only the agent's builder, who may be asleep or the source of the problem. The restart authority should be a named approver, different from the person who stopped the agent. This separation is the same separation-of-duties principle you apply to production access generally; agents deserve no exception.
How do you test a kill switch?
Run the five-step drill in a non-production environment first, then in production during a quiet window with the owner present. It takes about 45 minutes. Score four measures: time from the stop decision to the agent's last action, actions after the stop (target zero), minutes to produce the full write list, and whether restart is blocked without recorded approval. Moring publishes this drill as a free asset you can run against any agent, including ones built without Moring.
How does Moring implement kill switches?
Moring's control plane revokes the agent's identity at the gateway, so blocked calls are denied before execution — the agent's own code is never trusted to stop itself. In-flight work is drained by the runtime, and every prior action is already recorded as tamper-evident evidence with before/after values, so the write list is a query, not an investigation. Restart requires a recorded approval from a named approver. The drill above passes against the architecture by design, not by extra scripting.
Sources
- Moring AI — the agent kill-switch drill: Free 45-minute drill: stop it, prove it stopped, list what it did. Agent readiness checklist scores the drill. No signup.
- Moring AI — risk and control framework: Where the kill switch sits among the six control layers: AI agent risk and control framework.
Your agents can be stopped in one decision
If the honest answer to "how do you stop it?" is a deployment rollback, the agent is not resilient. We help teams build and drill real stop controls.
Talk to Moring