Informational Fresh portal_guide: PRD-115

Kill Switch

What it is. The enforcement arm of the AI Agent Control Tower: when you revoke an agent, the platform does not just record your intent — it reaches the runtime and physically isolates the agent's system, then records exactly what happened, executed or not.

Who it's for. Anyone accountable for the answer to "if an AI agent misbehaves right now, can you actually stop it — and prove you did?"

Features and what they mean

Feature	What it means
Revoke-triggered enforcement	Revoking an agent in the Control Register automatically engages the runtime kill-switch — one governed action, no side channel.
Runtime isolation	The target system is globally isolated: status ISOLATED, risk tier CRITICAL, execution stopped — until an operator explicitly reverts it.
Signed decision chain	In production the engagement is authorised by a cryptographically signed decision envelope, verified by the runtime before anything executes. A tampered or unsigned instruction is refused.
Machine credential	The service-to-service call carries a dedicated machine credential; calls without it — or with a wrong one — are rejected outright.
Failure-honest result	The outcome is recorded either way: `executed: true`, or `executed: false` with the reason. The platform never reports a kill it did not perform.
Hash-chained record	The revocation, the enforcement result and the runtime's own isolation entry are all tamper-evident, with a cross-domain audit link tying them together.
Explicit revert	Disengaging is its own recorded operator action — isolation never quietly expires.

What you put in, what you get out

You put in	You get out
A revoke action on a registered agent (actor + rationale)	Runtime isolation of the mapped system, or an honest failure with the reason
A mapping from your agent to its runtime system	Enforcement that lands on the right target
A revert decision (actor + rationale)	The system restored to active, recorded as its own audit event

Your first session

In the AI Agent Control Tower, pick a registered, approved agent — ideally a drill target, not your busiest production agent.
Revoke it with a real rationale. Read the response: the enforcement block tells you whether the kill executed and against which system.
Open the provenance chain and find the revocation entry, then run Verify full chain.
Have your operator revert the isolation, and confirm the revert is recorded too. A kill-switch you have never fired is a hypothesis — drill it.

Honest limits

Enforcement lands on systems registered in the Active runtime. An agent that is not mapped to a runtime system still gets a fully recorded revocation, but the physical kill has nothing to land on — the result will say so honestly.
Isolation is global for the target system — this is a stop button, not a throttle. There is no partial or per-capability kill.
The runtime also has its own autonomous drift monitoring that can isolate a system on a critical segregation-of-duties violation, independently of your revoke action. Two paths, one recorded outcome.

Access: included with the AGENT_CONTROL_TOWER entitlement — no separate SKU; fired from the AI Agent Control Tower surface at /agent-control-tower. See the AI Agent Control Tower lesson for the register, guardrails and approvals.