What Happens to In-Flight Transactions When an AI Budget Kill Switch Fires

The kill switch is a runtime decision, not a review

A budget or usage limit only matters if something enforces it while requests are running. A report that shows the limit was exceeded yesterday is a review. A kill switch is a policy decision evaluated in the execution path, at the moment a request, a streamed response or a tool call needs permission to proceed.

That raises a question many teams skip: when the threshold is crossed, what happens to everything already underway? Requests have been dispatched, responses are partway through streaming, and agents may be midway through a sequence of tool calls that write to downstream systems. If termination behavior is not defined, the result is partial outputs, incomplete actions, inconsistent state and no clear record of what was allowed, blocked or interrupted.

In this guide, "in-flight transactions" means individual interactions and tool calls. It does not mean business transactions that span tasks or agents, which is a different problem with different tooling.

A useful design analogue comes from financial markets. A 2014 NASDAQ rule filing described an optional kill switch with a participant-set exposure level, notifications as executed-order value approached it, disabled order entry once it was exceeded, and administrative cancellation of open orders. It also defined exceptions where cancellation is prohibited. The filing concerns securities orders, not AI, but its structure is instructive: threshold, warning, block new entry, deal with open work, and name the exemptions explicitly.

Four points at which a request can be interrupted

Mapping an AI request onto its lifecycle shows where enforcement can act. This mapping is a design framing rather than a standard, and the constraints at each stage differ.

Pre-call: the request has not been dispatched. Enforcement can allow it, block it, rate limit it or escalate it for human approval. Nothing has been generated and nothing has been written, so this is the lowest-risk interruption point. It is also the only point where a block leaves no partial state.

Streaming: the model is returning output and the user or calling application may already be consuming it. Terminating the stream is possible, but the consumer receives a truncated response. Whether that truncated output is shown, discarded or flagged is a policy decision. Provider-side processing may also continue after the connection closes, so the amount consumed against the budget may not match what was delivered.

Tool call: an agent has decided to invoke a tool, or a tool is already executing. Blocking before invocation is clean. Interrupting mid-execution depends on whether the tool can be cancelled and whether it has already changed something downstream.

Post-call: the response or action is complete. Enforcement here updates the budget state, blocks the next request and records the outcome. This stage matters for evidence, because it closes the record for the interaction.

Hard stop, drain and escalate compared

These are the three termination behaviors architects most often have to choose between. They are not mutually exclusive. Many designs apply different behaviors by request type, tool or risk level.

• Hard stop: Ends active streams and blocks pending tool calls immediately. Predictable and bounds further spend. Failure modes: truncated outputs, writes that began but did not finish, and callers that retry into the block. Evidence: a clear timestamp for the decision and a list of interrupted interactions.
• Graceful drain: Blocks new work while current interactions complete. Fewer partial outputs and less inconsistent state. Failure modes: the limit is overshot while work completes, long-running agent loops may never finish draining, and the drain window needs a defined ceiling. Evidence: which interactions were allowed to complete after the trigger, and why.
• Escalate for human approval: Holds the next action until a person approves or denies it. Suits high-consequence writes. Failure modes: stalled workflows, approvals that arrive after context has changed, and reviewer fatigue. Evidence: the request held, the approver, the decision and the elapsed time.

State and consistency risks when a tool call is interrupted

The hardest cases involve writes. A tool call that updates a record, sends a message or submits a request can be interrupted after the downstream system has accepted it but before the agent has seen the confirmation. The agent, the budget layer and the downstream system then disagree about what happened.

General engineering practice offers several mitigations. Classify tools as read-only, reversible or irreversible, and apply different termination behavior to each. Give write operations idempotency keys so a retry after interruption does not duplicate the effect. Define compensating actions for multi-step sequences where an earlier step cannot be left alone once a later step is blocked. Where an action should not be cancelled mid-flight, name it as an explicit exemption and record the rationale, as the NASDAQ filing does for periods when cancellation is prohibited.

Authorization is a related control. NIST has published design tenets for agent identity that include short-lived, dynamic and revocable authorization. Revoking an agent's credentials when a limit fires is one way to stop further actions, but how revocation interacts with a call already in progress needs to be specified, not assumed.

Where enforcement sits and what it does not cover

Enforcement in the execution path can see each interaction and each tool call as it is requested, and it can decide to allow, redact, block, rate limit or escalate. That is the scope of Trussed: policy enforced at runtime, not reviewed after the fact, across models, agents, tools and MCP servers, at the level of individual interactions and tool calls.

That scope has limits. Interaction-level and tool-call-level enforcement does not establish business transaction identity, and it does not provide transaction-level governance across tasks and agents or end-to-end tracing of agentic workflows. If a business process spans several agents and systems, a decision to stop one tool call does not tell you the state of the whole process. Reconciliation across systems needs its own design.

Regulatory direction is still forming. As of October 2026, H.R.9917, the AI Kill Switch Act, is a pending bill that would amend the Homeland Security Act of 2002 to require certain entities to maintain a technical capability to shut down certain technology, with an incident report due within 15 days of awareness of a covered incident. It has not been enacted. The NIST AI RMF Playbook, in its Manage guidance, refers to risks exceeding tolerance thresholds and to thresholds and metrics for actions that bypass or deactivate system components. Both point toward defining deactivation criteria in advance.