AgentWatchAgentWatch/Docs
Console →
On this page▾
Self-Hosted OverviewSecurity coverageData sourcesWhat the kill switch doesFailure modesMCP conformanceRequirementsQuickstart (Helm)Kustomize / kubectlStorage & PVCsAWS EKSGCP GKEAzure AKSOn-Prem / Bare MetalSecrets & Env VarsIngress & TLSCustomer dashboard imageAir-Gapped ClustersVerify InstallUpgradingBackup & RestoreTroubleshooting

The kill switch, in full

Approved 2026-10-26. The pricing page carries a short version; this is the long one. Behaviour is pinned by backend/tests/test_kill_switch.py.

It depends on how the agent is connected, and we tell you which applies to each agent. Killing a run stops that run. Isolating an agent goes further: it revokes every gateway key on the agent's passport, suspends the passport so a newly minted key is refused too, denies every tool, kills the agent's open runs and refuses new ones. Through Gate this is enforced: the agent's next model or MCP call is refused. Through the SDK it is cooperative: the next step gets HTTP 409 and the SDK raises AgentWatchKilled, but we cannot stop an agent between calls, or one that ignores the exception. On a passport in dry-run mode, isolating records what it would have done and changes nothing until you enforce it. Revoked keys stay revoked after you restore the agent. What we can do for every agent: we will tell you definitively if your agent ignored a stop command. Each step it tries after the stop is recorded with how many seconds after the stop it came, and the agent page shows its stop compliance.

Since 2026-10-26 a suspended, revoked or isolated passport also cannot have a new gateway key minted (create, rotate, onboarding and try-chat all return 409), so a key cannot be minted during isolation and wake on restore.

What isolate does, step by step

  1. Revokes every gateway key on the agent's passport (the next Gate call is 401).
  2. Suspends the passport, and refuses minting new keys while it is suspended.
  3. Sets an overlay that denies every tool.
  4. Kills the agent's open runs; the SDK's next step gets 409 and raises AgentWatchKilled.
  5. Refuses new runs for the agent (403 agent_isolated).

Under a dry-run passport, isolate records what it would have done and changes nothing until you enforce it. Restore lifts the suspension and the overlay; revoked keys stay revoked.

What it cannot do

It cannot stop an SDK-connected agent between calls, or one that ignores the exception: SDK enforcement is cooperative. Only Gate-proxied traffic is unbypassable. Every step an agent attempts after a stop is recorded with how late it was, and the agent page shows its stop compliance.