# What is Kill Switch?

Also called emergency stop, big red button.

A kill switch is a single control that halts a system's activity immediately, used when continued operation is causing harm. Unlike a gradual rollback, it prioritizes stopping over preserving in-flight work. In agent systems it typically stops new runs, cancels running ones, and blocks pending actions from executing.

A usable kill switch has specific properties. It must take effect in seconds, not after a deploy cycle. It must be operable by whoever is on call, without requiring the author of the offending change. It must have a defined scope, whether one tool, one agent, one tenant, or everything, so responders can stop the smallest sufficient thing. And it must be exercised periodically, because an untested emergency control is a hypothesis.

Stopping cleanly is harder than it appears. Work already dispatched to an external system cannot be recalled, so the switch must also prevent the results of in-flight work from triggering further actions. Practical implementations check the switch at the action boundary, immediately before any side-effecting call, rather than only at the entry point where a run begins. A run that started before the switch flipped should still be blocked from acting after it.

The switch is distinct from a circuit breaker, though both stop traffic. A breaker trips automatically on observed failure rates and resets on its own once health returns. A kill switch is engaged deliberately by a person, often for reasons no automated signal detects, such as an agent producing outputs that are technically successful but wrong, offensive, or unauthorized.

Restoration deserves as much design attention as engagement. Turning everything back on at once against a large backlog of queued work can reproduce the original harm at higher volume. A controlled resume, draining the backlog gradually while a responder watches the same signal that prompted the stop, is the safer default, and dropping rather than replaying stale queued work is often correct.

## Key points

- Single deliberate control that halts activity within seconds
- Needs defined scope so responders stop the smallest sufficient thing
- Checked at the action boundary, not only at run entry
- Distinct from a circuit breaker, which trips automatically
- Resume gradually; a backlog flood can repeat the harm

## In practice

A reviewer notices an agent sending outbound messages containing an internal draft note. An operator flips the messaging tool switch for all tenants. New runs proceed but every send is refused at the tool boundary, and 60 queued messages stay unsent. After the prompt is corrected, the operator inspects and releases the queued items in batches of ten rather than restoring the switch and flushing them at once.

## Related terms

- [Feature Flag](/en/glossary/feature-flag)
- [Circuit Breaker](/en/glossary/circuit-breaker)
- [Incident](/en/glossary/incident)
- [Blast Radius](/en/glossary/blast-radius)
- [Human Review Queue](/en/glossary/human-review-queue)

[Back to the AI Glossary](/en/glossary)