Run the agent kill-switch drill
Most teams can show you a disable button. Few have timed what happens after someone presses it: whether the call in flight completes, whether the next one is refused, whether the restart is authorised by someone other than the person who stopped it, and whether the record names both.
This is the drill. It takes about 45 minutes on one agent, first in staging and then in production during a quiet window with the owner present. Set the timer when the stop decision is made and write down T0.
What is inside
| Section | What it covers |
|---|---|
| The pre-flight table | Agent and environment, who may pull the switch, who may restart, target time to last action, where the record lives. |
| Five steps | Stop new actions, confirm the in-flight call, verify refusal, restart under a different approver, reconstruct the record. |
| Pass signs | What "it worked" looks like at each step, so the drill produces a result rather than an opinion. |
| Score sheet | A per-step result you can attach to the use-case review. |
How to use it
- Fill in the pre-flight table before anyone touches anything. The person who may restart must not be the person stopping it.
- Run it in staging first to find the documentation gaps while the blast radius is zero.
- Run it in production during a quiet window, with the workflow owner present and a target time agreed in advance.
- Time from the stop decision to the last action that reached a system of record. That interval is the number to report.
- Attach the resulting record to the use-case review. A drill nobody can evidence did not happen.
How do you test an AI agent kill switch?
What should a kill switch actually stop?
New actions, immediately, for that agent only. The next call must be refused at the gateway rather than failing inside the tool. Anything already in flight needs a defined answer — complete, roll back, or abandon — written before the drill, not decided during it.
Who should be allowed to stop an agent?
A role on call, not only the engineer who built it. If stopping requires the author, the control is unavailable exactly when it is needed. Restart should require a different named approver, which is what makes the stop meaningful.
How often should the drill run?
Before an agent goes to production, after any change to the gateway or credential path, and on a fixed cadence thereafter. A kill switch that has never been tested is a hypothesis, not a control.