Is a kill switch the same as a stop control?

Usually not, and the difference is where the work is left. A kill switch tends to mean cutting power to the process, which stops the agent and abandons whatever it was part way through. A stop control halts it between actions, so the state is known. Both are worth having and only one of them can be used without a decision about what to clean up afterwards.

How do you test a stop control without breaking production?

Run the agent on a slice, against test data or a small real batch, and stop it in the middle deliberately. What you are checking is not whether the button works but three things around it: whether somebody who is not the author can find it, how long it takes to take effect, and what state the work is left in. All three are cheap to establish in a test and expensive to discover during an incident.

Should an agent be able to stop itself?

It should halt after repeated failures instead of retrying forever, which is worth building and is not a stop control. Self-halting handles the failures the agent can recognize. The stop exists for the ones it cannot, which are the ones where it is confidently doing the wrong thing, and those are exactly the cases where its own judgment is the thing that has gone wrong.

How do you stop an AI agent mid-run?

You need a control that halts the agent between one action and the next, that somebody on shift can reach without a deployment, and that has been used at least once so you know it works and how long it takes. Many teams do not have one. What they have instead is the ability to revoke a credential or take the service down, which stops the agent by breaking something else, leaves whatever it was doing half finished, and takes as long as the slowest system in the path.

Why the stop is the control nobody has

Approval and rollback both get built because both are easy to imagine in advance. Approval is a design decision you make while writing the agent. Rollback is a thing you already have for other reasons, or believe you have.

The stop belongs to a moment nobody designs for: the agent is running, somebody has realized it is wrong, and it is still going. That moment is short, it happens under pressure, and it is not on anybody's diagram. So the control that serves it tends not to exist, and its absence is invisible until the one occasion it is needed.

It is also the only control that operates in that window. Approval happened before anybody knew. Rollback happens after the damage, and its cost is a function of how much damage there is, which is a function of how long the run continued.

What counts as a stop

Three properties, and a control that lacks any one of them is something else. It has to halt the agent cleanly, at a point where the work so far is in a known state rather than half applied. It has to be reachable by whoever is on shift, without a code change or a deployment. And it has to have been used, because a stop control nobody has exercised is a belief about a code path.

The fourth thing worth knowing is how long it takes. A stop that takes effect after the current step means the current step completes, and if the current step is a batch of two thousand, the stop was for the batch after this one. That is often acceptable and it is worth knowing rather than assuming.

Revoking a credential is not a stop by these tests. It halts the agent by making its next call fail, which leaves partial work in whatever system it was writing to, takes as long as the credential takes to propagate, and breaks anything else using the same credential.

Two routes back, and either one is a bound

Stopping and reversing are different controls answering different questions, and having one of them is a genuine position. If you can stop a run quickly, the amount of damage is bounded even where you cannot undo it. If you can reliably put things back, the amount of damage is recoverable even where you cannot stop it quickly.

Having neither is the case worth naming, because it is the case where a mistake continues for as long as nobody notices and then stays. Everything else on this subject is a matter of degree; that one is a difference in kind, which is why the assessment on this site treats it as a gate rather than as two low marks.

An agent where a person executes every effect has a third answer: the person is the stop. That is a real bound, and it is the reason moving from proposing to acting is a bigger change than it looks. It removes a control that nobody wrote down as a control.

Common questions

Is a kill switch the same as a stop control?: Usually not, and the difference is where the work is left. A kill switch tends to mean cutting power to the process, which stops the agent and abandons whatever it was part way through. A stop control halts it between actions, so the state is known. Both are worth having and only one of them can be used without a decision about what to clean up afterwards.
How do you test a stop control without breaking production?: Run the agent on a slice, against test data or a small real batch, and stop it in the middle deliberately. What you are checking is not whether the button works but three things around it: whether somebody who is not the author can find it, how long it takes to take effect, and what state the work is left in. All three are cheap to establish in a test and expensive to discover during an incident.
Should an agent be able to stop itself?: It should halt after repeated failures instead of retrying forever, which is worth building and is not a stop control. Self-halting handles the failures the agent can recognize. The stop exists for the ones it cannot, which are the ones where it is confidently doing the wrong thing, and those are exactly the cases where its own judgment is the thing that has gone wrong.

Find out where you stand

The assessment on this site asks up to 24 questions about what your agent can reach and what happens when it is wrong, and returns a score, a verdict and, where a control is short, the one thing to fix first. It takes about ten minutes, and questions your agent has no surface for are dropped rather than scored against you.

It is a self-assessment of design, permissions and recovery, not a penetration test, not an audit of a running system, and not a certification.

Run the assessment