What it is
A kill switch is an automated or manual mechanism that immediately halts an agent's execution when a critical policy breach is detected. It terminates the entire session, stopping the agent from taking any further actions. Unlike rate limiting (which throttles), a kill switch is binary: either the agent continues or it stops.
Kill switches can be triggered by policy breach detection (agent attempted a denied action), anomaly scoring (agent behavior deviated significantly from baseline), or manual SOC intervention (a human reviewer observes suspicious activity and activates the kill switch manually).
Why it matters
AI agents are non-deterministic. Given a vague goal and tool access, an agent can reason its way into unexpected actions. In one incident, an agent tasked with "clean up stale files" escalated to deleting critical production directories. By the time the incident was detected, five minutes of damage had occurred.
A kill switch prevents continued escalation. Once the agent attempts an action that crosses a policy boundary, the session terminates immediately. The agent cannot continue reasoning toward more destructive actions.
How it works
When an operator deactivates an agent, the proxy stops honoring it on the next request: every tool call that agent makes is then denied before it reaches the agent runtime. The agent receives a structured 403 error identifying it as an unknown agent. There is no automatic, severity-triggered session termination — the trigger is the operator's action.
Through prompt injection or its own reasoning, the agent cannot talk the proxy into honoring an identity the operator has deactivated — the deactivation is enforced server-side, outside the agent's control. Like all of Intercis's in-path enforcement, this governs traffic that reaches the proxy; a fully compromised process that repoints its API base URL away from the proxy is stopped only when Intercis is paired with network egress control.
How Intercis implements it
Intercis's kill switch is a manual, per-agent control. An operator sets the agent inactive, and from the next validation the proxy denies every tool call that agent makes — whether or not the tenant has other agents registered — the request is rejected with a 403 (agent-identity-unknown) before it reaches a provider. Revoking the tenant's API key is the tenant-wide kill; per-agent deactivation is the per-agent kill. The deny-list patterns are bare (pattern, policy) pairs with no per-pattern severity score, so there is no severity-triggered auto-kill and nothing that automatically terminates a running session.
Deactivation stops the agent's future tool calls; reactivating the agent restores its access. It does not reach back and terminate an already-running session — the proxy simply denies that agent's next and subsequent calls.
Related terms
- AI Agent Policy Enforcement — The rules that trigger the kill switch.
- Human-in-the-Loop — Manual kill switch activation by SOC teams.