Last updated: September 4, 2026
What an agent kill switch is
An agent kill switch is a control-plane action that stops production AI agent traffic at the gateway edge—faster and safer than chasing provider keys across microservices.
When agents call tools, databases, or model endpoints through a shared key, revocation is a company-wide incident. Kimss maps each agent identity on the gateway so operators can disable one agent without rotating every secret in the fleet.
See also AI agent security and enterprise AI control plane.
How Kimss implements it
Kimss enforces kill switch on the routed path: identity check, then allow or deny, then audit.
- Agents appear in inventory from registration or JIT discovery after gateway traffic.
- Operators disable an agent; subsequent governed requests for that identity are blocked.
- Gateway-verified records (and optional APIM GatewayLogs) remain for Article 12-style review.
- Connected Infrastructure (BYO) traffic still passes the Kimss edge, so the switch applies before your vaulted model endpoint.
When to use it
Use kill switch for runaway tool loops, compromised agent credentials, policy breaches, or vendor incidents—then investigate with the retained trail.
Pair kill switch with Hermis pause/guardrails, Threat Intercepts on paid tiers, and per-endpoint token caps on Provider Vault when the risk is spend rather than identity.
Frequently asked questions
Agent Kill Switch for production AI agents
Kimss provides an authoritative agent kill switch on the Secure Enterprise Agent Control Plane: operators can sever gateway access for a registered agent in one action so routed traffic stops, while gateway-verified audit records remain for the incident review.
Does a kill switch delete the agent?
No. Kimss disables gateway execution for that agent identity. Inventory and audit history stay available so you can investigate and re-enable when safe.
Does kill switch cover BYO model endpoints?
Yes for traffic that routes through Kimss. Connected Infrastructure calls still hit the Kimss gateway, so the kill switch applies before your vaulted provider endpoint is called.
Where do I operate the kill switch?
In the Kimss Agents surfaces after sign-in. See /docs/security_compliance and /ai-agent-security for the broader control-plane posture.