Control

Kill switch

An authorized user can stop a single deployment, or engage a kill switch that refuses all runtime traffic for an organisation. Each stop, resume and release is recorded with who, when and why, and every request refused while a stop is on is recorded as a blocked decision on the same evidence trail as policy blocks.

The two are independent and both are checked on every request, with no cache, so a stop applies on every API replica from the next call. Releasing the kill switch does not resume deployments stopped one by one. Configuration changes stay allowed while a stop is on, so you can fix the problem before you resume.

Stop one deployment

Stop
POST /deployments/{id}/stop with an optional reason. Anyone who can deploy to the deployment.
Resume
POST /deployments/{id}/resume. Organisation owners and admins.
Refusal
400 “Deployment is stopped. Resume the deployment before sending requests.”
Record
Who stopped or resumed it, when, why, and the key or agent used, in the same transaction as the stop.

Stop an organisation

Engage
POST /orgs/{org_id}/runtime-halt with a reason (required). Organisation owners and admins.
Release
POST /orgs/{org_id}/runtime-halt/release with an optional reason. Owners and admins.
Refusal
423 Locked with { decision: "blocked", stage: "org_halt", org_id, reason, resolution }. The OpenAI and Anthropic SDKs do not retry a 423.
Record
Who engaged or released it, when and why; every owner and admin is emailed, and matching alert rules fire.

In the portal: Settings → Danger zone → Kill switch, which asks for a reason and the organisation's name. Personal deployments of the organisation's members stop with it.

What stops

  • /run, sync and streaming
  • The gateway: /v1/chat/completions, /v1/messages and /v1/embeddings
  • The MCP action gateway, including approving a paused action
  • Chat conversations and Slack
  • Claude Code agent hooks: pre-tool-use returns block
  • Retrieval (/rag/run, /retrieval/query) and knowledge ingestion
  • Eval suite runs and policy extraction
  • Queued self-hosted jobs, which are cancelled when the worker picks them up
  • Workflows: execute is refused, and a running workflow parks before its next node

Work already in flight

  • New requests are refused on the next call, on every API replica.
  • Responses already streaming end within about two seconds: the provider connection is closed and one final error event is sent in the stream's wire format, which the OpenAI and Anthropic SDKs raise as an error. Output held back for an output policy is never released.
  • Work already running finishes its current step: a non-streamed provider call returns, a workflow agent node finishes its loop, a job that has started runs to completion.
  • Hybrid data planes (Sync Agent installs) do not receive the stop yet. Stop a deployment on the data plane itself.

Parked work is blocked, not cancelled

  • Workflow runs waiting for approval become blocked; a blocked run cannot be approved, but can be rejected or cancelled.
  • MCP approvals requested before a stop are paused; approving one returns 409 until it is unblocked. Rejecting is always allowed.
  • Resuming and releasing do not unblock anything. An owner or admin unblocks each item once no stop applies to it, and each unblock is recorded.

Evidence

  • Every refused request is a blocked decision in Decision Audit, with the code (deployment_stopped or org_runtime_halted), the surface it was refused on, and the caller — a person, or a registered agent.
  • Every stop, resume, engage and release is in the platform audit log with who, when and why.
  • Audit bundles list the stops, resumes and kill-switch changes in their change history.

Limits

  • Stops are manual: there are no threshold-triggered stops, and one person engages or releases the kill switch.
  • The gateway response cache is not cleared on stop; an identical prompt can be answered from the cache after resume until the entry expires.
  • Other deployment writes (config edits, rollback, applying a pack) wait for open streams on that deployment to finish; the stop endpoints don't.