AI Agent Kill Switch: Define It Before You Launch Yours

Saturday, four in the afternoon. You are away from your laptop and an agent in production falls into a loop: it calls the same tool again and again, burns through budget and writes to customers what it should not. Who shuts it down? And how long does that take?

In my article on Salesforce agents I ended with a question: who hands the agent the keys, for which doors and for how long. Today comes the sister question, the one almost nobody wants to answer before launch: how do you take those keys back when something goes wrong?

What Salesforce says already exists

According to the Salesforce Mexico press release from September 2026, Agent Kill Switch is now generally available as part of Agent Fabric, through Omni Gateway. The text starts from the same Saturday-afternoon scenario and says that on most platforms the only measure available is tearing down the environment where the agent runs, which also disconnects the agents that work well.

Here is what Salesforce describes:

• Four possible scopes: a single request, a session, a specific instance of an agent or an entire tenant in an emergency.

• Hard Stop: halts traffic immediately and blocks the agent's communication with Model Proxy and with other agents on the network.

• Restore: returns the agent to the exact state it was in before the freeze, with no manual data repair.

• A tamper-proof, hash-chained log of who intervened, in what scope, what it affected and when.

All of that comes from the vendor and I have not tested it. There are also three things I could not confirm: the price, the licenses it requires and whether the same button reaches agents on other platforms. The press release does not clarify them. If you plan to evaluate it, ask Salesforce those three questions directly.

You write the rules for your AI agent kill switch

What helped me most in the press release is its argument. Salesforce says operators hesitate to pull the lever when the signal is ambiguous, and that hesitation turns minor incidents into expensive ones. If every intervention can be reversed, it says, a false positive costs seconds and a weekend of cleanup drops out of the bill. My take is that the argument holds: a cheap brake gets used on time and an expensive one gets postponed.

Your team defines the rules of the button. Before production, you should be able to answer four questions for each critical agent:

• What stops: a request, a conversation, the whole agent?

• Who can shut it down, even on a Saturday, without asking for three permissions.

• What happens to work already in progress, such as emails half sent or records half written.

• How it gets restored and who gives the green light to turn it back on.

The press release itself closes with two similar tasks: define what soft stop and hard stop mean for each critical agent and document it before you need it, and run a deactivation and restore test on an agent that is not in production. To me that is the most honest part of the text.

When to stop hard and when to stop gently

This criterion is mine, with no backing from the vendor.

Stop immediately (hard stop) when:

• The agent can write to customers or move money and the error repeats.

• You suspect it drifted from its instructions, for example through prompt injection, a scenario the press release mentions.

• You do not know what it is doing. If you cannot explain it, stop it.

Stop gently, limited to one request or one session, when:

• The failure sits in one specific conversation and the rest works.

• The agent only proposes and a person approves, so nothing goes out on its own.

• Stopping everything would cost more than the error itself.

A brake pays off more with monitoring beside it. In its Dreamforce 2026 roundup, Salesforce presents Agent Health Monitoring, which it marks as generally available, with more than 16 built-in metrics and alerts, and Custom Scorers, with the API generally available and the interface still in beta, to grade sessions against your own criteria. Salesforce positions them as a way to catch the failures that go unnoticed. Confirm the status of each piece before you build your plan on it.

So here is the uncomfortable question: if your agent makes a mistake tonight, do you know who shuts it down and what happens next? If the answer is "someone will sort it out", it is not ready for production yet.

Sources:

• Salesforce Mexico, "El botón de apagado que la IA agéntica necesitaba: Agent Kill Switch ya está disponible para todos" (September 2026, in Spanish)

• Salesforce, "21 Things We Announced at Dreamforce 2026" (items 14 and 18)