How do I build a kill switch for an autonomous AI agent?

What should I check, step by step?

1. Write down what the agent can touch: tools, API keys, OAuth tokens, payment methods, databases, outbound network. Each one needs a way to be shut off that doesn't depend on the agent.

2. Put one check in front of every tool call, in code the agent can't edit: a pre-tool hook, a wrapper around each tool, or a proxy that holds the real credentials. The check reads an on/off flag kept outside the agent's process.
3. Fail closed. If the check errors, times out or can't be reached, the action must be refused, not allowed. Many hook systems default the other way, so check yours.
4. Cover every path, not just your own functions. Built-in shell, browser and hosted tools often skip the hooks you add to custom tools.
5. Back it with revocable access: short-lived tokens you can revoke, one card per agent you can freeze, and keys that belong to the agent alone, so turning them off doesn't break anything else.
6. Make it reachable by the humans who need it: an owner (and an on-call backup) should be able to flip it from a phone in under a minute, and the flip itself should be logged with who and when.
7. Keep two levels: a pause you can lift (block new actions) and a revoke that's permanent (burn the credential, issue a new one if you resume).
8. Drill it. Flip the switch in a test run, confirm the next tool call is refused, then confirm resume works. A kill switch nobody has tested is a guess.

Where the check goes in common agent frameworks (checked Oct 30, 2026)

Claude Code: a PreToolUse hook runs before every tool call, MCP tools included, and can block it (exit code 2, or JSON with permissionDecision "deny"). Its docs say a hook that can't start, exits with any other code, times out or gets an HTTP error is a non-blocking error and the tool runs anyway, unless the hook sets onFailure: "block". Exit 1 does not block. Set onFailure: "block" on a kill-switch hook.

• Claude Code hooks merge across settings levels, and disableAllHooks can't disable managed hooks from outside managed settings, so a kill-switch hook in managed settings can't be switched off by a project file the agent can write. Command and HTTP hooks default to a 600-second timeout; set a short one.
• OpenAI Agents SDK: tool guardrails wrap function tools and run every time the tool is called; an input tool guardrail can skip the call or raise a tripwire. They don't apply to hosted tools (WebSearchTool, FileSearchTool, HostedMCPTool, CodeInterpreterTool, ImageGenerationTool), built-in execution tools (ComputerTool, ShellTool, ApplyPatchTool, LocalShellTool) or handoffs, so those need their own off switch.
• Agent-level input guardrails in the same SDK run in parallel with the agent by default, so the agent may already have run tools before a tripwire cancels it. Use blocking mode (run_in_parallel=False) for checks that must happen first.

The layers under the switch

Credentials: revoke or rotate the keys and tokens the agent holds. Short-lived, per-agent credentials make this quick and keep the blast radius to one agent.

• Money: with Stripe Issuing, setting a card's status to inactive declines every authorization and can be undone; canceled is permanent. An Issuing balance funded with only the agent's budget caps what it can spend even if every other check fails.
• Process: stopping the container or job ends the current run, but a scheduler, retry loop or second worker can start it again. Turn off the trigger as well, and don't treat a stopped process as proof the agent's access is gone.

What can go wrong?

The flag is checked once at startup, so a long run never sees it flip.

• The check fails open: the policy service is down and the hook's error is ignored.
• The agent can edit the file or setting that holds the switch, or holds the same credentials the switch is supposed to protect.
• Only custom tools are guarded; the agent reaches the same system through a shell, browser or hosted tool.