Implementation guide
OWASP AISVS v1.01
Monitoring, Logging & Anomaly Detection · Proactive Security Behavior Monitoring
Log kill-switch use
Verify that kill-switch activations and override commands are logged.
OWASP AISVS v1.01, requirement 12.4.3
In plain English
Log every use of the kill switch and every manual override. These are the most powerful controls in the system. You need to know who used them, when and why, to learn from incidents and to notice misuse.
What good looks like
- Each activation records who, when, the scope and the reason.
- Override commands, such as forcing an action through or resuming after a stop, are logged the same way.
- Logs are kept where the agent and its operators cannot alter them.
- Activations are reviewed afterwards.
How teams usually do it
- Logging built into the kill-switch and override tools, written to the central, append-only store.
- A required reason field.
- An alert to the security team on every activation.
Suggested evidence
- Sample entries from a test.
- The post-incident review of a real or drill activation.
Common mistakes
- A kill switch that works and leaves no record.
- Overrides made by editing configuration directly, outside any logged tool.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.