Coding-Agent Kill-Switch Drills: Price the Shutdown Path Before an Incident

A Stop Button Is Not a Shutdown System

A coding-agent kill switch works only if it stops active compute, revokes identity, blocks delegated network paths, preserves evidence, and prevents automatic restart. Testing that chain consumes engineering time and temporary capacity, but discovering a broken link during an incident is far more expensive. Treat shutdown as a production capability with an owner, service objective, and recurring drill budget.

Map every execution surface: desktop sessions, CI runners, cloud sandboxes, browser tasks, child agents, scheduled jobs, deployment hooks, and external API calls. Identify the control plane for each and the maximum time before it honors cancellation. Include queues not yet started; a stopped worker is useless if the scheduler immediately launches its replacement from the same event.

Define Drill Scenarios

Run at least four scenarios: one session behaves unexpectedly, one credential is suspected compromised, one model cohort must be paused, and the entire fleet must stop. Inject the event at different boundaries, such as during a tool call, after an external write, while a deployment starts, and during network loss. Use nonproduction resources that faithfully reproduce identity and control paths.

State success before the drill. Measure time to detect, authorize, cancel compute, revoke credentials, cut egress, freeze artifacts, and reconcile side effects. Require proof from the target systems rather than a green control-plane response. An API may accept cancellation while the workload continues briefly. The evidence should show the last command, last network event, and final identity status.

Price the Exercise

Count preparation, participant time, temporary environments, monitoring, interrupted agent work, recovery, and follow-up fixes. Add the opportunity cost of reserved responders. Avoid turning the drill into a theatrical all-hands event; the objective is repeatable evidence. A focused two-hour exercise every quarter can be cheaper and more informative than an annual simulation nobody remembers how to operate.

Estimate avoided incident cost with ranges, not a guaranteed return. Faster shutdown can reduce token burn, cloud runtime, unauthorized changes, secret exposure, and forensic scope. Compare the control's maintenance cost with the reduced duration and blast radius of plausible failures. Even rare events can justify modest recurring spend when consequences are high.

Handle Unknown External State

Cancellation does not undo completed side effects. After a timeout or lost response, query the authoritative system using a stable task or request identifier. Determine whether a commit, ticket, deployment, or notification already exists before retrying or compensating. Blind rollback can be as destructive as the original action. Document which effects are reversible, compensatable, or require human investigation.

Preserve logs, command history, model and prompt versions, policy decisions, credential identifiers, and hashes of changed artifacts. Quarantine without deleting. Evidence retention has storage and privacy cost, so define scope and expiry in advance. Responders need enough state to explain what happened without keeping sensitive conversation content forever.

Close the Loop

Every failed step becomes tracked work with owner and due date. Retest the specific path after repair, then include it in the next full drill. Update runbooks, dashboards, and automation together. A command copied into documentation but never exercised will decay as infrastructure changes. Version the shutdown procedure with the systems it controls.

Publish a compact scorecard: coverage, stop time by layer, residual side effects, evidence completeness, recovery time, and drill cost. Trend improvement rather than declaring pass forever. Kill-switch readiness is an economic control because it bounds loss when normal automation assumptions fail. The budget buys a short, verified path from suspicious behavior to contained, explainable state.

Exercise Human Authorization

Create a decision record for the end-to-end shutdown authorization path. Capture page time, responder identity check, delegated authority, decision latency, cancellation time, credential revocation, egress cutoff, remaining side effects, and recovery approval. Store the record with the accepted artifact rather than only in a temporary model transcript. This evidence lets engineering reproduce an outcome, finance explain the bill, and reviewers distinguish a real improvement from a lucky run. It also makes exceptions visible instead of allowing them to become undocumented defaults across future sessions.

The main failure to avoid is that a technically fast switch sits unused while responders search for someone allowed to press it. Define an owner, a measurable threshold, and an expiry date for the decision. retest escalation schedules and preauthorized thresholds during every quarterly drill. When evidence falls outside the approved range, stop expansion, preserve state, and investigate before buying more attempts. This operating discipline converts a one-time technique into a bounded policy that can remain economical as models, tools, teams, and repositories evolve.

Include queued and scheduled work in the exercise so stopped sessions are not silently recreated by a healthy scheduler.