Who can shut an AI agent down, and how fast?
A kill switch is two actions, not one button. Stop what the agent is running, then cut what it can reach. It is finished only when you have proof: no new output after one full cadence, and a call that worked before is now refused. The owner and at least one administrator who is not the owner should be able to do both.
Most teams find out whether they have a kill switch during an incident. That is the worst time, because the person who knows the agent may not be there, and nobody has practised the steps.
Stop, cut, prove
| Action | What it stops | Proof |
|---|---|---|
| Stop | Work in progress: loops, schedules, repeating jobs | No new output after one full cadence |
| Cut | Access: what the agent can reach with its credentials | A call that worked before is now refused |
| Prove | Your own assumption that the first two worked | Both proofs recorded by someone other than the person who acted |
Stopping without cutting leaves an agent that could be restarted with its old access. Cutting without stopping leaves work running that will fail noisily, or quietly. You need both.
Rendering diagram…
Who should hold the switch
Two people, named before the agent goes live:
- The owner, who knows what the agent is for and what stopping it will break.
- An administrator who is not the owner, so the agent can still be stopped when the owner is on holiday or has left the company.
An agent only its builder can stop is a ghost agent waiting to happen.
How to do it in agent.ceo
Stop its loops
A loop in agent.ceo accepts a stop signal. Send it, then prove the stop:
BASE=https://api.agent.ceo/api/v1/orgs/$ORG
KEY="X-API-Key: $ORG_API_KEY"
curl -s -X POST "$BASE/loops/$LOOP_ID/signal" -H "$KEY" -H "Content-Type: application/json" \
-d '{"signal_type": "stop"}'
# note the step and outputs, wait one full cadence, then read again: nothing new
curl -s "$BASE/loops/$LOOP_ID" -H "$KEY"
sleep 63
curl -s "$BASE/loops/$LOOP_ID" -H "$KEY"
curl -s "$BASE/loops/$LOOP_ID/artifacts" -H "$KEY"
The wait matters. A loop that was about to run its next turn can look stopped for a few seconds. One full cadence later, the step count and the outputs must not have changed. The full walk-through is in how to create, watch and stop an agent loop.
Cut its keys
API keys in agent.ceo are scoped and revocable. Before you revoke, keep one call that works with the key. After you revoke, repeat it and require a refusal:
# before revoking: expect 200
curl -s -o /dev/null -w "%{http_code}\n" \
"https://api.agent.ceo/api/v1/customers/$ORG/agents" -H "X-API-Key: $AGENT_KEY"
# revoke the key, then repeat the same call: expect a 4xx refusal, never 200
curl -s -o /dev/null -w "%{http_code}\n" \
"https://api.agent.ceo/api/v1/customers/$ORG/agents" -H "X-API-Key: $AGENT_KEY"
A key that shows as revoked in a list is not proof. The refused call is.
Practise it before you need it
| Drill | How often | Pass when |
|---|---|---|
| Stop a test loop and wait one cadence | Each time you add a loop pattern | Step and outputs unchanged |
| Revoke a test key and repeat a call | Each time someone new gets admin | Call refused |
| The non-owner admin does both, alone | Once a quarter | They finish without asking the owner |
FAQ
What is an AI agent kill switch?
Two actions, not one button. First stop what the agent is running, such as its loops and schedules. Then cut what it can reach by revoking its credentials. A kill switch is only proven when a call that worked before is now refused and the agent produces no new output after its normal cadence.
Who should be able to shut an AI agent down?
At least two people: the agent's owner and an administrator who is not the owner. If only the owner can stop it, the agent cannot be stopped when the owner is away or has left. Name both before the agent goes live and make sure both know the steps.
How fast can you stop an AI agent?
The stop signal itself takes seconds, but the honest measure is how long until you can prove it stopped. For a loop that means waiting one full cadence and confirming nothing new appeared. For a credential it means one refused call. Practise both before you need them.
Related: How do you stop an AI agent loop from running forever? · API keys docs