AI agent kill switches need defined stop outcomes, not just disabled credentials

A hypothetical invoice-processing agent that keeps resubmitting jobs shows why disabling its principal may not halt harm, since it could still use model keys, write files, or leave queued work running. The author argues a kill switch should be treated as a testable procedure, distinguishing containment, which blocks specified consequential actions, from quiescence, which also requires running and outstanding work to reach verified terminal states. Recommended artifacts include a stop scope listing effects and execution units, a shutdown protocol assigning independent authority, and an acceptance report recording coverage and timing. The piece also notes that token revocation is not uniform: refresh and access token revocation carry different guarantees, and self-contained tokens may keep working until resources check them. Each new tool integration should therefore specify both the authority it adds and how that authority will be withdrawn.