Kill switch
An instant control that stops an agent or tool server from acting, immediately.
category ▸ Operations
Kill switch, in plain language.
A kill switch is the ability to halt an agent or a capability right now, with one decisive action. When something is going wrong — a runaway loop, a compromised tool, an agent acting outside its remit — the priority is containment, and a kill switch provides it without waiting for a deploy or a config change to propagate.
A credible kill switch is fast, scoped, and reversible: it takes effect immediately, stops exactly the thing that needs stopping, and can be lifted once the situation is understood. It is the operational expression of being able to say "stop" and have it actually stop.
How Cortex implements it.
This term isn't abstract here — it maps to a real capability in the runtime. Here is exactly how Cortex enforces or relates to it.
Cortex provides kill switches at multiple levels. The MCP Gateway's block is an instant kill switch on a tool server — blocked servers refuse every invocation (403) until re-approved. In the Control Tower, an operator can pause or kill an agent's activity live.
Cost governance acts as an automatic kill switch on spend: once projected spend would exceed a hard cap, the run is blocked (402) rather than allowed to burn budget.
Keep building the vocabulary.
These terms sit next to this one in the governed-AI model — follow the thread to see how the controls connect.
Control Tower
The live operations console for the whole agent fleet — watch, gate, pause, or kill.
MCP Gateway
A governance layer over every Model Context Protocol tool an agent can call.
Cost governance / hard cap
Spend limits on agents and tenants, with a hard cap that blocks a run before it overspends.
Fail-closed
When a control can't confirm an action is safe, it denies rather than allows.
See Kill switch enforced, not just defined.
Book a walkthrough and watch the controls in this glossary return real verdicts, seal real evidence, and trace every fact back to its source.