Implementation guide
OWASP AISVS v1.01
Orchestration & Agentic Security · Shutdown and Graceful Degradation
Kill switch on a separate channel
Verify that kill-switch commands are implemented through an out-of-band channel that is isolated from the agent runtime.
OWASP AISVS v1.01, requirement 9.6.3
In plain English
Send kill-switch commands through a channel that is separate from the agent runtime and that the agent cannot block, read or alter. A switch that relies on the misbehaving system to cooperate is not dependable. This is a Level 3 control.
What good looks like
- The kill switch works when the agent runtime is hung, compromised or ignoring instructions.
- The agent has no access to the control channel or its credentials.
- The stop is enforced at a layer the agent does not control.
- It has been tested against an unresponsive runtime.
How teams usually do it
- Platform-level actions: revoke the agents' credentials, cut network access, or scale the workload to zero from the infrastructure control plane.
- Disabling the model API key or gateway route from a separate administrative account.
- Separate credentials and a separate network path for the control plane.
Suggested evidence
- The design showing the separate channel.
- A test record against a stuck runtime.
- Access policy showing the agent cannot reach the control channel.
Common mistakes
- A kill switch that is a message sent to the agent.
- A stop flag stored in a database the agent can write to.
- Kill-switch credentials kept in the same secrets store as the agent's.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.