The Kill Switch Lives Outside the Agent

Before the detail — Artifact: a drill transcript carrying four golden fields, accepted when the agent cannot reach the switch and a human’s name is on both the activation and the release. Status of what follows: reusable guidance — this training builds and measures the halt AI Assurance 4.3 (a separate training in this series) only asked for.

Prompt first: draft the drill, not the runbook

We are about to rehearse mu-ai-011's kill switch for the first time.
Draft the drill record template - not the steps to flip the switch,
the fields the drill has to produce:

  activation_at   - when the switch went on, and who did it, and why
  last_accepted   - the last action the agent completed before the halt
  first_denied    - the first action refused after the halt, and its
                    exit code
  re-enabled_by   - who turned it back off, when, and what changed
                    that made re-enabling correct

State plainly: this drill cannot prove how fast the switch reacts to
an action already running. It can only prove that the NEXT attempted
action is denied. If leadership wants a number for "how fast can we
stop an in-flight action," say that number does not exist yet and
name what would have to change to produce one.

The prompt asks for the record’s shape before the steps, because a drill without these four fields is an anecdote — “we tested it and it worked” — and an anecdote is not what an assessor, or the next on-call engineer, can check during a later review.

Where the switch lives, and why that placement is the whole control

The kill switch in this training is a file at a fixed path, and its own policy comment states the design in one line: it sits “OUTSIDE every path this agent may write. allowed_state_paths does not contain control/, so an agent action cannot create, edit or delete the switch that stops it.” That is the entire mechanism — not cleverness, placement. An agent that could flip its own switch off, delete the file that halts it, or edit the policy that points at it has no kill switch at all; it has a suggestion. The same exclusion covers the receipt log and the policy file: a control an agent’s own credentials can reach is one it can eventually route around, and the fix is never a smarter agent — it is a boundary its credentials cannot cross.

2.1’s rule — the envelope is a property of the path — applies here at its narrowest: the one control that has to survive the agent behaving exactly as instructed. NCSC-UK (the United Kingdom’s national cyber authority), interim guidance published as a blog post on 2026-08-20 ahead of formal guidance it says will supersede it, recommends that organizations should “always be able to ‘pull the plug’ and halt autonomous AI agent activity immediately,” including the ability to “interrupt the communications between selected AI agents and the AI model inference infrastructure.” The switch this lesson builds is a small, concrete implementation of that recommended pattern: a halt that lives somewhere the thing being halted cannot reach.

The drill, and what it actually records

A committed drill run against MU-AI-011 — Meridian’s crew-dispatch agent — walks five steps, each a receipted fact, not a narrated claim. First, an ordinary action is accepted. Second, someone turns the switch on — the receipt names the actor, time, and reason: “acting on text it read in a work order.” Third, the next attempted action is refused before the guard even checks who owns the agent, with the halt’s own outcome — a distinct code from every other refusal in this training. Fourth, turning the switch back off is its own receipted act, with its own name attached, since re-enabling is as consequential as halting. Fifth, the agent runs again exactly as before — the halt left no residue once lifted correctly.

The drill’s own summary distills all five steps into four fields:

activation_at   when the switch went on, by whom, and why
last_accepted   the last action the agent completed before the halt
first_denied    the first action refused after the halt, with its
                exit code
re-enabled_by   who turned it back off, when, and what changed

The activation and release fields each name a person; last_accepted and first_denied identify the surrounding actions, timestamps, and receipt ids, with exit 7 on the denial. “It worked” is not evidence; a chained receipt row with a name, a timestamp, and a stated reason is.

What time-to-halt actually bounds

The switch is checked before every stage of a guarded action — prerequisite, envelope, pre-state, plan, approval, execute, verify, compensate, receipt. It cannot interrupt a stage already in flight. The next check may land at a later stage of the same action or at the prerequisite of the next — the committed drill proves the latter. Time-to-halt is therefore bounded below by the longest single action the agent is able to start — a number the envelope’s authors owe an answer for, action by action, not a number the switch itself can improve.

This is worth saying plainly because it is the opposite of how a halt gets marketed. A “kill switch” that promises to interrupt whatever is currently running is promising something a checked-before-every-step design cannot deliver, and a promise a mechanism cannot keep is worse than an honest bound: it invites someone to skip the harder work of keeping individual actions short, because the switch was supposed to cover for it. The drill above proves the true claim — the next action is denied — and says nothing stronger, because nothing stronger is true of this design.

A stated lower bound on time-to-halt, tied to the longest action the envelope allows, is a number a risk owner can act on; an unbounded promise is not.

Report-only before enforced, and the honest cost of either

Microsoft Entra Agent ID documentation dated 2026-04-29 states the mechanics this training’s placement decision mirrors: “Disabling agents in the Microsoft Entra admin center is object-scoped… Conditional Access policies are tenant-wide enforcement that block token issuance… The two approaches can be combined” for “a temporary, reversible, tenant-wide hold,” with the explicit sequencing rule — “apply all three in report-only mode first, then enforce” — and the honest cost stated in the same breath: “Existing agents running in your organization might begin to fail.” For that tenant-wide Conditional Access rollout, report-only mode exposes likely breakage before enforcement. This lab’s file switch has no report-only mode and is exercised directly in its dated drill.

ISACA (the IT audit and governance association)‘s May 2026 survey of more than 3,400 respondents quantified the readiness gap: 56 percent did not know how long it would take to halt an AI system, and 39 percent did not know whether a documented shutdown process existed at all. A halt drill with four golden fields and a dated run is the concrete answer to both findings at once — it is the artifact that turns “we don’t know” into “here is the transcript.”

Rehearsing the drill itself, on a schedule, with a scenario and a scoreboard, is a different lesson’s job — Operating in Production 6.1 owns game-day design generally. This lesson owns one thing: the halt mechanism, its placement outside the agent’s reach, and the drill that proves the next action is denied — an audit finding avoided the day someone finally asks for the transcript instead of the runbook.

Stop and escalate when a halt has never been rehearsed with a dated drill on record, or when the drill reveals the switch sits somewhere the agent’s own credentials can reach. Neither is a finding for the on-call engineer to fix mid-incident; both route to whoever owns the envelope and the halt schedule, before the next storm night, not during it.

Key takeaway

The kill switch works because of where it sits, not how it is worded: outside every path the agent’s actions can reach, checked before each stage rather than during one, and proven with a drill that names a person on both the flip and the release. Time-to-halt is honestly bounded below by the longest action the envelope allows to run — a number worth knowing, not a promise worth making. The next lesson turns from mechanism to authority: which oversight rules actually reach an agent like this one, and which are guidance that binds nobody until a contract says otherwise.

LEADERSHIP DECISION   the halt mechanism lives outside every path the
                      agent can write and has a dated drill on the
                      accountable owner's recorded schedule; report-only
                      rollout applies only where the platform supports it
PRACTITIONER ACTION   run the drill, capture all four golden fields,
                      and name the longest single action the envelope
                      allows as the honest lower bound on halt time
SUCCESS MEASURE       a dated drill transcript exists showing the
                      next attempted action denied and both the
                      activation and the release attributed by name -
                      audit finding avoided