Stop one agent, a whole team, or everything, now
Checked before every other control. Stops new governed work; it cannot recall actions already dispatched. The head of IT at eleven at night, with one agent nobody can explain The stop takes as long as a deploy takes and depends on the owning team being awake. The person who noticed the problem and the person who can end it are in different time zones.
Revoking a key and redeploying both take longer than the incident allows.
Revoking a credential works on the next authentication attempt, for the calls that use it, in the systems where you can find it, and an agent running six months may hold one key at the gateway and a second directly against a vendor. Redeploying takes as long as a deploy takes and needs the owning team awake, which is usually the bottleneck.
4 steps, in this order.
Decide the blast radius first
One agent when the misbehaviour is contained. One team when you do not yet know which agent. Everything, when you do not know.
Engage it with a real reason
Engagement is admin-only and the reason is mandatory. Every affected caller's refusal names the scope, the person and the reason.
Check what it did not reach
New requests from every subject the scope selects are refused with a 403 at the first check. Dispatched requests are not recalled.
Convert it into a durable decision
A kill switch is an emergency posture, not a lifecycle state. If the agent should not run again until reviewed, suspend it.
Choose from four controls for pausing or restricting future work.
See what a stop reachesBuilt for
- Agents and seats enrolled with Token Observe, where a stop can be scoped to one subject or everything.
- A deployment with named admins: engaging and releasing are both admin-only and neither can be anonymous.
- An incident review that will read the blocked traces, because every refusal still opened a trace.
Wrong for
- Anyone who needs a call already dispatched to be recalled. A request already on the wire completes and is billed.
- Anyone who needs to stop an agent that does not route through Token Observe.
- Anyone who expects it to end a vendor subscription. Only the vendor's own console ends the entitlement.
One thing on the record
Token counting and the model-catalogue routes deliberately skip the trace-opening path because they execute nothing, and in skipping it they also skipped the agent-status and kill-switch checks, so a frozen agent could still price prompts and enumerate models.
Those checks now run on all three routes, and the gap and its closure are in the known-issues log. Engage a switch, then call the token-count route.
Where this is publishedThree scopes, and one predicate behind all of them.
A team switch compares team names case-insensitively, because a team name is typed by a human under incident pressure and a capital letter should not decide whether a fleet stops. The predicate that answers whether a switch reaches a subject is written once and exported: the same function the gateway stops a request with decides which switches are compiled into a seat's signed policy bundle.
- global
- Every governed subject, refused with a 403 naming the scope, the person who engaged it and the reason they gave.
- team
- Matched case-insensitively against the subject's team, so a newly registered agent joining it is stopped without anyone adding it.
- agent
- One subject id. Pointed at a seat id, it stops that seat's device-side enforcement at the next bundle it holds.
- Never licence-gated
- The gateway, permissions, redaction, approvals, budgets, the flight recorder, the audit chain and the kill switch are in every tier.
Anything that speaks an OpenAI-compatible, Anthropic or Gemini dialect. One base URL and one key change.
Authorise, redact, budget, decide. Then forward, refuse, or hold for a human.
Fails closed. A decision it cannot make is a request that does not go.
OpenAI, Anthropic, Google Gemini, OpenRouter, Amazon Bedrock, Azure OpenAI, MCP tool servers, and any OpenAI-compatible endpoint you host.
Registry, policy decisions, the hash-chained audit log and the flight recorder. Held in your database, on your disk. Nothing goes to the vendor.
Four controls sit underneath the big red button.
Reaching for the switch when something narrower would do is how an incident becomes an outage. The narrowest is a policy, which blocks one action rather than stopping the agent and is the only one you can rehearse in shadow mode. Next is the lifecycle state, then the credential (the right tool when the problem is who holds the key), and finally the budget, the only brake that acts without a person.
4 things this still does not solve.
- A kill switch cannot recall a request already dispatched to a provider, and it cannot undo a tool call that has already executed upstream.
- It cannot stop an agent that does not route through Token Observe, which makes the stop only as broad as your coverage.
- It cannot revoke a vendor subscription. Retiring a seat stops that seat reaching Token Observe, and only the vendor's own console ends the entitlement.
- Nothing engages it automatically. A policy can block a request and suspend the agent, but a team or global stop is a person's decision with a stated reason.
Check the product limits alongside the job you want to do.
What we do not claimThe parts that do the work.
Spend controls
Hard USD ceilings, per-minute rate limits and a kill switch, all decided before the request leaves your network.
One billable egress: no retry, no failover
Agent registry
One record per agent, and it is the record the gateway enforces against.
An overdue review never suspends the agent itself
Policy engine
One deterministic verdict on every governed request: allow, block, redact, or park it for a human.
Injection scoring is nine fixed patterns, not a model
Questions
Does the kill switch stop calls that are already in flight?
No. It is checked at the start of every governed request, so it refuses new work rather than recalling a call already dispatched. What it covers is broader than the model gateway: it runs on token counting and the model-catalogue routes too, which open no trace because they execute nothing and once skipped the check with them.
How fast does a stop take effect?
On the agent's next governed request. There is no propagation step and no redeployment, because the resolver loads the agent, its roles and the switches in force live from the store. The one exception is a developer seat, where enforcement happens inside the vendor's own hook against a signed bundle it already holds.
Can we make it engage automatically on a threshold?
Not the switch itself. A policy can act without a person: its suspend_agent action blocks the request and takes the agent out of service, and if the status write fails the block still stands. A team-wide or global stop stays a human decision with a stated reason, because a threshold cannot write the sentence explaining why a fleet stopped.
Describe the version of this you have.
Say what your estate contains and which part of it worries you, and the reply will say where to start.