Govern
Kill & break-glass
Stop the blast radius fast, and temporarily bypass policy when a human explicitly owns the risk.
What it is
Kill / pause switches block enqueue (and can cancel in-flight runs) for a tenant or agent. Break-glass is a time-bounded window that bypasses policy Decide, not auth, not kill, not rate limits.
Why it is here
Incidents need a single choke point. Per-script SIGTERM does not scale across frameworks and replicas.
How to use it
- Admin → Kill, upsert a kill or pause for tenant/agent; confirm in-flight cancel behavior.
- Clear the switch when the incident is over so enqueue resumes.
- Break-glass, create a window with reason + expiry (max 24h); revoke early if possible.
- Review Audit afterward, break-glass is meant to be loud and temporary.
In the product
Admin → Kill: refuse new creates; optional drain of in-flight runs
Admin → Break-glass: time-bounded policy bypass (max 24h)
What to expect
- Kill: new work stops; optional cancel of non-terminal runs in scope.
- Break-glass: policy allows that would otherwise pending/deny may proceed; kill still wins.
- SQL only: these Admin routes return 501 on Mongo for governance durability.
- Full step-by-step: see Admin UI guide → Kill switches and Break-glass for a detailed walkthrough of each screen.
Reference: docs/admin.md · docs/trust-governance.md · Ops