Why AI Agents Need a Durable Cancellation Protocol, Not Just a Stop Button

A simple stop button is insufficient for real-world AI agents, where work may already be queued, in-flight, or triggering external side effects at the moment cancellation is requested. Developers are advised to model cancellation as durable state using a defined run lifecycle: ACTIVE, CANCELLING, CANCELLED, COMPLETED, and UNKNOWN. A versioned cancel_version field stored in a database allows workers to validate whether a dispatch is still permitted, closing race conditions between operator actions and worker execution. Cancellation checks must be enforced at every boundary that can create work, including queue claims, tool dispatches, retries, and outbound deliveries, rather than only at the top of the agent loop. Ambiguous outcomes, such as when a worker process dies mid-request, should be recorded as UNKNOWN and reconciled via provider APIs rather than silently resolved into success or failure.