When an AI Cost Spike Should Trigger a Kill Switch Instead of an Alert

The kill switch is one point on a spectrum

Framing the question as a kill switch versus an alert hides the options in between. An alert depends on a person noticing it, reading it and acting. Agents, tool calls, coding assistants and model integrations can generate abnormal token or request volumes within minutes. Common causes are runaway loops, prompt abuse, compromised credentials and misconfigured agents. While an alert waits for a response, spend and the associated risk exposure keep accumulating.

Treat a cost spike as a runtime control and risk signal, not as a budgeting event. Unusual consumption can indicate that a system is behaving outside its intended use. NIST defines prompt injection as an attack that exploits the concatenation of untrusted input with a prompt built by a higher-trust party. That makes it a plausible cause of abnormal activity, although it is only one of several.

The NIST AI RMF Playbook (MANAGE 2.4) expects mechanisms to be in place and applied, with assigned and understood responsibilities, to supersede, disengage or deactivate AI systems whose performance or outcomes are inconsistent with intended use. It also suggests identifying incident thresholds for activating bypass or deactivation. The practical implication is that thresholds are defined before deployment, not argued over during an incident.

Five criteria that separate alert-worthy from enforcement-worthy

The criteria below are a design framework, not a published standard. Score each anomaly class against them in advance.

Signal type and source. Ask what is actually being measured and where the anomaly originates. Tokens per interaction, request velocity, tool-call recursion depth, per-identity consumption and deviation from baseline are plausible inline signals, and each points to a different cause. Recursion depth suggests a loop. A single credential consuming far outside its usual pattern suggests compromise or misconfiguration. Signals tied to an identifiable failure mode justify stronger action than a general drift in volume.

Rate of change. Velocity matters more than magnitude. A gradual rise leaves time for a human to investigate. A step change or steep acceleration can exceed any plausible response time, which is the strongest argument for automatic action.

Blast radius. Consider how many identities, tools, data sources and downstream systems the workload can reach. A spike in an isolated internal prototype is a different problem from one in an agent with write access to production systems.

Reversibility and consequence of interruption. Blocking a batch summarization job is cheap to undo. Blocking a workload that supports a clinical, claims or customer-facing process may carry its own harm. Where interruption is costly, prefer a rate limit or human approval over a full stop.

Confidence in the signal. A high-confidence indicator, such as recursion beyond a defined limit, can justify automatic blocking. A noisy baseline deviation may justify only an alert or a throttle. Low confidence combined with high interruption cost is the clearest case for alerting or escalation.

A tiered response policy

Map risk tolerance tiers to response tiers. The Playbook describes tolerances ranging from negligible to critical, but the mapping to specific actions is a design decision for each organization. One workable structure follows.

• Tier 1: Alert: Trigger: slow, contained deviation, low confidence, high cost of interruption. Action: notify the named owner. Resume: not applicable.
• Tier 2: Rate limit: Trigger: sustained elevated velocity, cause unclear. Action: throttle at the identity or workload level and notify. Resume: automatic when consumption returns within bounds.
• Tier 3: Escalate for human approval: Trigger: large consumption step or high-consequence tool call, moderate confidence. Action: hold the interaction or call until an approver decides. Resume: on recorded approval.
• Tier 4: Block: Trigger: high-confidence runaway or abuse indicators, such as recursion beyond a defined depth. Action: stop the interaction or identity. Resume: by a named role after review.
• Tier 5: Deactivate workload: Trigger: repeated Tier 4 events or a declared incident. Action: disengage the system. Resume: by the role holding documented shutdown authority.

Why enforcement belongs in the execution path

Review after the fact cannot stop spend that accelerates faster than people can respond. Policy enforced in the execution path acts on each interaction and tool call as it happens, so a threshold crossing changes what is allowed immediately instead of generating a ticket. Aggregate billing views show that a spike occurred. They generally cannot stop the next call.

Identity is the hard part. NIST AI 800-4 notes that the use of agent identifiers is not yet standardized or mature, and that visibility into unanticipated agent activity is an emerging challenge. State which identity each threshold is keyed to: user, service account, agent or API key. A per-user limit does little against an agent running under a shared service account.

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Its actions are allow, redact, block, rate limit and escalate for human approval, applied to individual interactions and tool calls. When evaluating any runtime enforcement layer, ask which signals it can evaluate inline, which actions it can tier by threshold, and which identities it can key policy to.

Evidence to retain and the governance behind it

After an intervention, a risk owner or auditor will ask what triggered it, what was allowed, what was stopped and who approved any override. NIST SP 800-61r3 lists roles, responsibilities and authorities among incident response considerations, including which roles may shut down or disconnect technology assets. MANAGE 2.4 likewise expects deactivation responsibilities to be assigned and understood. Approvals and overrides should therefore map to named roles.

A practical record includes the policy and threshold version in effect, the signal values that crossed it, the identity involved, the action taken, the interactions or tool calls allowed before and after, the approver and their role, timestamps, and who or what resumed the workload. This list is an inference from accountability principles, not a mandated format.

On the regulatory side, H.R.9917, the AI Kill Switch Act, is proposed legislation as of October 2026, not current law. It would amend the Homeland Security Act of 2002 to require certain entities to maintain a technical capability to shut down certain technology. It also contemplates incident reports within 15 days of an entity becoming aware of a covered incident. It points in the same direction as the NIST material: defined shutdown capability and a record of what happened.

Enforcement at runtime produces evidence as a by-product. Trussed generates audit-ready evidence from enforcement, mapped to HIPAA, NAIC, NYDFS, EU AI Act and NIST, which lets a regulated enterprise show what its AI was allowed to do and what it did.