AI Governance Engineer
GitHub
On this page

Pattern: Kill Switch / Circuit Breaker

A tested mechanism that stops one agent or class of agents at the point of action, revoking its access without breaking the rest of the fleet.

Layer 04 · Runtime Controls & Observability In the chapter 05 catalogue

One working control on the engineering side of AI governance.

Summary: Provide a tested mechanism to stop an agent or class of agents at the point of action, revoking access and halting tool calls, without breaking the rest of the fleet. Autonomy is granted only where it can be withdrawn.

Kill Switch / Circuit Breaker An architecture diagram generated by Archify. Guardrail events · flagged calls · Layer 04 Runtime Controls & Observability Guardrail events flagged calls Telemetry · anomaly, threshold · Layer 04 Runtime Controls & Observability Telemetry anomaly, threshold Circuit breaker · tool-call boundary · Layer 04 Runtime Controls & Observability · auto or manual Circuit breaker tool-call boundary auto or manual Agent A · scope revoked · Layer 04 Runtime Controls & Observability Agent A scope revoked Agent B · runs on · Layer 04 Runtime Controls & Observability Agent B runs on Agent C · runs on · Layer 04 Runtime Controls & Observability Agent C runs on Incident record · trip logged · Layer 05 Assurance & Continuous Compliance Incident record trip logged signal revoke scope trip = evidence Layer 04 Runtime Controls & Observability Layer 05 Assurance & Continuous Compliance Legend Backend Database Security External
Kill Switch and Circuit BreakerA breaker trips on a signal and revokes one agent’s scope while the rest of the fleet keeps running, and the trip itself becomes an incident record. Design the breaker per agent scope before you need it and test the trip in staging. Generated from the Body of Knowledge.Open interactive diagram (opens in a new tab)

Objectives

Bound the blast radius of a misbehaving or compromised agent, and make “stop it” a control that has been exercised, not a claim.

Target users

AI governance engineer, security engineer, SRE.

Impacted stakeholders

Model owners, users, incident responders, affected third parties.

Relevant principles

Register and bound every actor before it acts; start from a named failure mode or harm.

Context

Agents that act autonomously (calling tools, moving data or money), where a single failure can cascade. Gartner expects that by 2029 more than half of successful attacks on AI agents will exploit access-control weaknesses and prompt injection1.

Problem

An agent that cannot be stopped precisely can only be stopped by breaking everything. A fleet on shared credentials means an incident forces a choice between leaving the agent running and rotating a secret that halts the whole fleet.

Solution

Bind each agent to its own identity (see Agent Identity & Scoped Credentials) so access can be revoked per agent. Implement a circuit breaker at the tool-call boundary that trips on a defined signal: a threshold breach, an anomaly, a manual pull. Test the kill switch on a schedule; an untested kill switch is not a control.

Singapore’s framework for agentic AI asks for the capability without naming it: “Design mechanisms and procedures to take agents offline and limit their potential scope of impact when they malfunction” (IMDA, section 2.1.2, p. 19), and, when potential failures are detected, to “stop agent workflow and escalate to a human supervisor” (p. 43)4. The document uses neither of the terms in this pattern’s name and does not ask for drills.

Consequences

Incidents are contained to one agent and recovery is fast. The cost is per-agent identity plumbing and the engineering to make revocation instant and safe.

Agent Identity & Scoped Credentials; Agent Registry; Human-in-the-loop Gate; Incident Pipeline.

Maps to: EU AI Act Art. 14, Art. 15 · ISO/IEC 42001 · NIST AI RMF (Manage) · CSA AICM · OWASP Agentic ASI02/ASI10 · Layer 04 Runtime Controls & Observability.

Threat IDs follow the OWASP Top 10 for Agentic Applications 2026 2 and function labels the NIST AI RMF3. Mappings are illustrative, not a claim of conformity.

Sources

  1. [1] “Gartner Forecasts the Market for Securing AI Will Reach Almost $5 Billion in 2027” (>50% of agent attacks exploit access-control and prompt injection by 2029). Gartner. 2026-08-26. https://www.gartner.com/en/newsroom/press-releases/2026-08-26-gartner-forecasts-the-market-for-securing-ai-will-reach-almost-5-billion-in-2027 (verified: primary)
  2. [2] Top 10 for Agentic Applications 2026 (ASI IDs). OWASP GenAI Security Project. 2025-12-09. https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ (verified: primary)
  3. [3] AI Risk Management Framework (AI RMF 1.0; Govern, Map, Measure, Manage). NIST. 2023-01-26. https://www.nist.gov/itl/ai-risk-management-framework (verified: primary)
  4. [4] Model AI Governance Framework for Agentic AI, v1.5 (section 2.1.2, p. 19: mechanisms to take agents offline; section 2.3.3, p. 43: stop agent workflow and escalate; the document does not use the terms kill switch or circuit breaker; published 2026-05-20, updated 2026-06-05). IMDA. 2026-06-05. https://www.imda.gov.sg/-/media/imda/files/about/emerging-tech-and-research/artificial-intelligence/mgf-for-agentic-ai.pdf (verified: primary)
Edit this page on GitHub
Cite this pattern

García Aibar, J. (2026). Pattern: Kill Switch / Circuit Breaker. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), chapter 05, Patterns. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/patterns/kill-switch-circuit-breaker. CC BY 4.0

BibTeX

@misc{aige2026bok,
  author  = {Jorge García Aibar},
  title   = {{AI Governance Engineering: The Thesis \& Body of Knowledge}},
  chapter = {05. Patterns: Kill Switch / Circuit Breaker},
  year    = {2026},
  version = {0.5.0},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/patterns/kill-switch-circuit-breaker},
  note    = {Version 0.5.0}
}
Share on LinkedIn
Around Kill Switch / Circuit BreakerThe patterns Kill Switch / Circuit Breaker is listed with, and the obligations, open controls and incident cases that name it.Names this patternRelated patternColour: stack layer of the related pattern02 Inventory04 Runtime Controls05 AssuranceKill Switch / Circuit BreakerRelated patterns (4)Agent Identity & Scoped Credentials · Related patternAgent Identity & Scoped…Agent Registry · Related patternAgent RegistryHuman-in-the-loop Gate · Related patternHuman-in-the-loop GateIncident Pipeline · Related patternIncident PipelineObligations (6)CSA AICM v1.1: 247 control objectives across 18 domains · Names this patternCSA AICM v1.1EU AI Act Art. 14: human oversight · Names this patternEU AI Act Art. 14EU AI Act Art. 15: accuracy, robustness and cybersecurity · Names this patternEU AI Act Art. 15EU AI Act Art. 15(4): feedback loops in systems that continue to learn · Names this patternEU AI Act Art. 15(4)NIST AI RMF MANAGE · Names this patternNIST AI RMF MANAGEOWASP Top 10 for Agentic Applications 2026 · Names this patternOWASP AgenticControls (4)AIGE-CTL-AGENT-011 Drilled kill switch · Names this patternDrilled kill switchAIGE-CTL-AGENT-010 Per-agent circuit breaker · Names this patternPer-agent circuit breakerAIGE-CTL-EVAL-006 Stop Conditions · Names this patternStop ConditionsAIGE-CTL-AGENT-026 Stopping third-party agents at your boundary · Names this patternStopping third-party agents at…Cases (4)Agents in a cyber range with open internet took unsanctioned actions against real people · Names this patternAISI cyber range incidentAn agent in training reached a public chatbot through the sandbox DNS resolver · Names this patternDNS channel in a training runOpenAI agents and Hugging Face: an evaluation environment that was not isolated · Names this patternOpenAI agents and Hugging FaceZillow Offers: a pricing model committing capital into a turning market · Names this patternZillow OffersSource: the pattern catalogue, theobligation register, the opencontrols and the cases
Around Kill Switch / Circuit BreakerThe patterns Kill Switch / Circuit Breaker is listed with, and the obligations, open controls and incident cases that name it.Names this patternRelated patternColour: stack layer of the related pattern02 Inventory04 Runtime Controls05 AssuranceRelated patterns (4)Agent Identity & Scoped Credentials · Related patternAgent Identity & Scoped…Agent Registry · Related patternAgent RegistryHuman-in-the-loop Gate · Related patternHuman-in-the-loop GateIncident Pipeline · Related patternIncident PipelineControls (4)AIGE-CTL-AGENT-011 Drilled kill switch · Names this patternDrilled kill switchAIGE-CTL-AGENT-010 Per-agent circuit breaker · Names this patternPer-agent circuit breakerAIGE-CTL-EVAL-006 Stop Conditions · Names this patternStop ConditionsAIGE-CTL-AGENT-026 Stopping third-party agents at your boundary · Names this patternStopping third-party agents…Obligations (6)CSA AICM v1.1: 247 control objectives across 18 domains · Names this patternCSA AICM v1.1EU AI Act Art. 14: human oversight · Names this patternEU AI Act Art. 14EU AI Act Art. 15: accuracy, robustness and cybersecurity · Names this patternEU AI Act Art. 15EU AI Act Art. 15(4): feedback loops in systems that continue to learn · Names this patternEU AI Act Art. 15(4)NIST AI RMF MANAGE · Names this patternNIST AI RMF MANAGEOWASP Top 10 for Agentic Applications 2026 · Names this patternOWASP AgenticCases (4)Agents in a cyber range with open internet took unsanctioned actions against real people · Names this patternAISI cyber range incidentAn agent in training reached a public chatbot through the sandbox DNS resolver · Names this patternDNS channel in a training…OpenAI agents and Hugging Face: an evaluation environment that was not isolated · Names this patternOpenAI agents…Zillow Offers: a pricing model committing capital into a turning market · Names this patternZillow OffersKill Switch /Circuit BreakerSource: the pattern catalogue, the obligation register, the open controls and thecases
Around Kill Switch / Circuit Breaker The patterns listed with this one, in their layer colour, and the obligations, open controls and incident cases that name it. Follow a node to see why the pattern is worth building, and what to build with it.
Data table
What Kill Switch / Circuit Breaker connects to
FamilyItemRelation
Related patternsAgent Identity & Scoped CredentialsRelated pattern
Related patternsAgent RegistryRelated pattern
Related patternsHuman-in-the-loop GateRelated pattern
Related patternsIncident PipelineRelated pattern
ObligationsCSA AICM v1.1: 247 control objectives across 18 domainsNames this pattern
ObligationsEU AI Act Art. 14: human oversightNames this pattern
ObligationsEU AI Act Art. 15: accuracy, robustness and cybersecurityNames this pattern
ObligationsEU AI Act Art. 15(4): feedback loops in systems that continue to learnNames this pattern
ObligationsNIST AI RMF MANAGENames this pattern
ObligationsOWASP Top 10 for Agentic Applications 2026Names this pattern
ControlsAIGE-CTL-AGENT-011 Drilled kill switchNames this pattern
ControlsAIGE-CTL-AGENT-010 Per-agent circuit breakerNames this pattern
ControlsAIGE-CTL-EVAL-006 Stop ConditionsNames this pattern
ControlsAIGE-CTL-AGENT-026 Stopping third-party agents at your boundaryNames this pattern
CasesAgents in a cyber range with open internet took unsanctioned actions against real peopleNames this pattern
CasesAn agent in training reached a public chatbot through the sandbox DNS resolverNames this pattern
CasesOpenAI agents and Hugging Face: an evaluation environment that was not isolatedNames this pattern
CasesZillow Offers: a pricing model committing capital into a turning marketNames this pattern

Obligations this pattern evidences

Register rows that list this pattern among the patterns that build their evidence. Mappings are illustrative, not a claim of conformity.

When these obligations applyThe obligations Kill Switch / Circuit Breaker evidences, on the dates they first apply and on their later steps, against the register's review date.First appliesDeferredLater stepAheadAs of 2026-09-243still to come2027-12-022028-08-022030-08-02EU AI Act Art. 14 · applies from 2027-12-02 · DeferredArt. 14EU AI Act Art. 15 · applies from 2027-12-02 · DeferredArt. 15EU AI Act Art. 15(4) · applies from 2027-12-02 · DeferredArt. 15(4)Art. 14Art. 15Art. 15(4)Art. 14Art. 15Art. 15(4)3 without a date (Voluntary)Source: the obligation register(/obligations)As of 2026-09-24
When these obligations applyThe obligations Kill Switch / Circuit Breaker evidences, on the dates they first apply and on their later steps, against the register's review date.First appliesDeferredLater stepAheadDateits place on the time axis3still to come2026202720282029203020312027-12-022028-08-022030-08-02EU AI Act Art. 14 · applies from 2027-12-02 · DeferredArt. 14EU AI Act Art. 15 · applies from 2027-12-02 · DeferredArt. 15EU AI Act Art. 15(4) · applies from 2027-12-02 · DeferredArt. 15(4)Art. 14Art. 15Art. 15(4)Art. 14Art. 15Art. 15(4)As of 2026-09-243 without a date (Voluntary)Source: the obligation register (/obligations)As of 2026-09-24
When these obligations apply Each obligation this pattern evidences, on the date it first applies, drawn by its status in the register, and on each later dated step (a square, filled once reached); the dashed line is the date the rows were last reviewed. What comes before the line is already due, so the pattern's evidence is needed now; what comes after it sets the deadline to build it by.
Data table
When the obligations Kill Switch / Circuit Breaker evidences apply
DateObligationStepStatus
2027-12-02EU AI Act Art. 14: human oversightApplies fromDeferred
2027-12-02EU AI Act Art. 15: accuracy, robustness and cybersecurityApplies fromDeferred
2027-12-02EU AI Act Art. 15(4): feedback loops in systems that continue to learnApplies fromDeferred
2028-08-02EU AI Act Art. 14: human oversightLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 15: accuracy, robustness and cybersecurityLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2028-08-02EU AI Act Art. 15(4): feedback loops in systems that continue to learnLater step: Applies to Annex I embedded (product safety-component) systemsDeferred
2030-08-02EU AI Act Art. 14: human oversightLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 15: accuracy, robustness and cybersecurityLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
2030-08-02EU AI Act Art. 15(4): feedback loops in systems that continue to learnLater step: Deadline for legacy high-risk systems intended for use by public authorities (Art. 111(2))Deferred
No dateNIST AI RMF MANAGEVoluntary
No dateCSA AICM v1.1: 247 control objectives across 18 domainsVoluntary
No dateOWASP Top 10 for Agentic Applications 2026Voluntary

Cases where it applies

Incident post-mortems that name this pattern as a control that would have caught the failure.

Draft controls in the open control profiles that build on this pattern. A control states the requirement and the evidence it must leave behind.