Reading Time: 7 minutes

Something goes wrong with an agent in production on a Saturday afternoon. 

It’s looping through tool calls and burning tokens, or it has been talked out of its instructions by a prompt injection. 

On most platforms the only available lever is tearing down the runtime the agent runs on, which takes every healthy agent beside it offline and still leaves several minutes on the clock while your customers or your token budget absorb the damage.

Closing that gap is what Agent Kill Switch does, and it is generally available today as part of Agent Fabric via Omni Gateway.

Contain one agent instance, not the whole runtime

The right response to an incident is rarely all or nothing, so the intervention should be sized to the problem in front of you.

Scope a stop to a single request when one call went wrong, to a session when a specific conversation has gone sideways, to an individual agent instance when the behavior is systemic, or to an entire tenant in a genuine break-glass moment.

  • Sized to the incident. Contain a rogue agent without taking down the twelve agents running correctly alongside it.
  • Hard Stop,  stop cuts traffic immediately when waiting is the greater risk and block agent talking to Model Proxy and other agents in the network.

Wrong calls cost seconds, not weekends

Operators hesitate to pull an emergency lever when the signal is ambiguous, and hesitation is where minor incidents become expensive ones. Every intervention is reversible with a single Restore, which returns the agent to the exact state it held before the freeze without manual data repair.

This modifies the calculus when trying to get ahead of incidents; acting early on a suspicion becomes the rational choice, because a false positive costs a few seconds of downtime rather than a weekend of cleanup.

Block the entire proxy fleet, not just a single connection

Quarantining an agent instance shouldn’t just break a local connection; it should shut down every path forward. Enforcement operates at the model proxy level, blocking traffic across every Model Proxy simultaneously rather than stopping at a single gateway.

Once an agent instance is quarantined, no proxy in the system will route its traffic, and no neighboring agent will accept its requests. Alternate proxy paths, cached instructions, and automated retries are rendered completely inert.

Every intervention leaves a record

“The agent decided to” does not survive a regulatory review. Every kill action writes a tamper-evident, hash-chained record covering who intervened, at what scope, what it affected, and when.

That record does double duty. Your compliance team gets documentation that stands up to the standards expected, and your incident reviews start from real lineage instead of a reconstruction pieced together from logs.

Ship agents your CISO will sign off on

Teams commit more to production when the downside is bounded, reversible, and provable. An agent you can scope, halt, restore, and account for is an agent your security organization can sign off on, which moves the conversation from whether to deploy to how fast.

Get started:

Ready to secure your AI journey?

  • Decide what soft stop and hard stop mean for each of your critical agents, and document it before you need it.
  • Run a kill and a restore against a non-production agent so the first real one is not the first attempt.

The goal of AI isn’t to replace human judgment, but to be supported by it. By setting clear policies and having a literal “off” button that works across your entire ecosystem, you change the calculus of risk. You move from a place of “deploy and hope” to “deploy and lead”.