Implementation Guide
Shutting down enterprise AI agents within minutes: runtime kill switch and containment controls
An AI agent kill switch is a set of tiered controls, enforced at runtime and outside the agent's own logic, that stops an agent from acting without a redeploy.
What a kill switch has to be
Minutes-level containment depends on three things being in place before an incident:
- Distinct agent identities, so one agent can be stopped without affecting others.
- Scoped and revocable permissions, so access to specific systems or data can be removed.
- A central point where tool calls and model requests can be refused.
Tiered containment options
Design graduated options, from pausing one agent to cutting off a gateway. Each tier widens the scope of containment, and each should be available to the people who may need to use it.
| Tier | Control | What it does |
|---|---|---|
| 1 | Agent suspension | Stops one agent identity from acting. |
| 2 | Credential and permission revocation | Removes access to specific systems or data. |
| 3 | Tool-call and MCP blocking | Denies named tools or servers by policy. |
| 4 | Gateway or network cutoff | Halts model, tool, or fleet traffic centrally. |
Failure modes that slow shutdown
When any of the prerequisites above is missing, containment slows down. Questions worth asking of an existing design:
- If agents do not have distinct identities, can access be revoked for one agent without affecting others?
- If controls live inside the agent's own logic rather than at runtime, does stopping the agent require a redeploy?
- If policy is not managed centrally, how long does a change take to reach every enforcement point?
Set triggers and assign decision authority
Define the triggers for each containment tier, and assign decision authority in advance. Deciding who may act, and at which tier, before an incident begins keeps the shutdown path short when minutes matter.
Verify containment, keep evidence, and test
Verify the effect of every shutdown. A confirmed shutdown can be shown, for example, by blocked calls being refused and no new downstream actions occurring.
Audit logging should cover every tool call, MCP interaction, and shutdown action, preserving evidence from before and after containment.
Test each tier. Containment levels, from one agent to a whole fleet, should each be exercised in testing rather than assumed to work.
Evaluating a runtime control layer for emergency containment
- Does each agent have a distinct identity, so access can be revoked for one agent without affecting others?
- Can policy changes be made centrally, enforced at runtime outside the agent's logic, and how long does a change take to reach every enforcement point?
- Does it support graduated containment, from one agent to a whole fleet, and can each level be exercised in testing?
- Can it block specific tools and MCP servers per call, including approval workflows for new tools?
- Is audit logging produced for every tool call, MCP interaction, and shutdown action, preserving evidence from before and after containment?
- Can it confirm that a shutdown took effect, for example by showing blocked calls refused and no new downstream actions?
Review your containment options
Trussed AI provides runtime governance and security for enterprise AI agents, including agent identity, permissions, runtime policy enforcement, and audit logging. Talk to an expert about how these controls apply to your containment design.
Talk to an Expert