Give every AI feature, model, tool and prompt a tested off switch, and decommission agents cleanly

Evidence grade

Standards consensus (4)

4 standards and frameworks · 1 graded incident.

TwinEthos recommendation, not law. Where binding law applies, the law governs. No binding law in the corpus requires this control yet. 4 standards and frameworks recommend it (NIST AI RMF 1.0, NIST GenAI Profile (AI 600-1), NIST SP 800-218A, OWASP ASI 2026). 1 graded incident cited. Context: binding law on related controls in the family “AI decisions lack effective human review, override, or contest” is in force in 33 jurisdictions (AE-DU-DIFC, BR, CA-QC, CH, CN, EC, EU, GB, IT, KE, KG, KR, KZ, NG, SA, TR, US, US-AL, US-AZ, US-CA, US-CO, US-IA, US-IL, US-IN, US-MD, US-ME, US-NE, US-NV, US-RI, US-TX, US-VT, UZ, ZA).

Standards and frameworks

• Deployed AI should have override, decommission, and monitoring mechanisms (United States (federal) (US); NIST AI RMF 1.0 — MANAGE 4.1; same control)
• GenAI systems should be able to be deactivated, against criteria set in advance (NIST GenAI Profile GV-1.7-001, MG-2.4-004) (NIST GenAI Profile (AI 600-1); NIST AI 600-1, GV-1.7-001 (deactivation protocols); same control)

Published AI security standards mapping to this control

• OWASP ASI 2026 ASI04: Agentic Supply Chain Vulnerabilities · crosswalk status: covered
• OWASP ASI 2026 ASI10: Rogue Agents · crosswalk status: covered
• NIST AI 600-1 GV-1.7-001: Protocols ensure GAI systems can be deactivated when necessary · crosswalk status: covered
• NIST AI 600-1 MG-2.4-004: Establish and regularly review criteria that warrant deactivating GAI systems · crosswalk status: covered
• NIST SP 800-218A RV.2.2: Criteria and process to stop using a model · crosswalk status: covered
• NIST AI RMF MANAGE 2.4: Mechanisms to supersede, disengage, or deactivate · crosswalk status: covered
• NIST AI RMF MANAGE 4.1: Post-deployment monitoring, appeal and override, incident response, change management · crosswalk status: covered

Item ids and titles from the published standards; the mapping is TwinEthos's (standards crosswalk, docs/COVERAGE.md Part 4). Cited by id, never quoted.

Family “AI decisions lack effective human review, override, or contest”: binding law on related controls is in force in AE-DU-DIFC, Brazil (BR), Quebec (CA-QC), CH, China (CN), EC, European Union (EU), United Kingdom (GB), IT, KE, KG, South Korea (KR), KZ, NG, SA, TR, United States (federal) (US), Alabama (US-AL), Arizona (US-AZ), California (US-CA), Colorado (US-CO), Iowa (US-IA), Illinois (US-IL), Indiana (US-IN), Maryland (US-MD), Maine (US-ME), Nebraska (US-NE), Nevada (US-NV), Rhode Island (US-RI), Texas (US-TX), Vermont (US-VT), UZ, ZA; enacted, not yet applying in AE, CL, Georgia (US-GA). Context only: it does not change this guardrail's grade.

Graded incidents

• Coding agent deleted a production database during a code freeze (2025-07; confirmed) The Register · evidence grade: press of record

The guard to add

for call in response.tool_calls:
    result = TOOLS[call.name](**call.arguments)

ld = ldclient.get()
ctx = Context.builder('support-agent').kind('service').build()
tracer = trace.get_tracer('agent')

for call in response.tool_calls:
    if not ld.variation('ai-agent-enabled', ctx, False):   # operators flip it, no deploy
        raise AgentDisengaged('kill switch off')
    if breaker.is_open():                                   # e.g. error or refund spike
        raise AgentDisengaged('circuit breaker open')
    with tracer.start_as_current_span('agent.tool_call') as span:
        span.set_attribute('tool.name', call.name)
        result = TOOLS[call.name](**call.arguments)
    ACTIONS.labels(tool=call.name).inc()                    # alerted in Prometheus

Why

When an AI feature misbehaves, a compromised tool turns up or a prompt change goes wrong, the useful question is how fast it can be turned off everywhere, and the answer should not be a redeploy. A switch that nobody has flipped may not work when it is needed, and a feature switched off with no fallback becomes an outage, so the switch, its fallback and the drill belong together. An agent that is retired but keeps its credentials is an identity nobody watches. NIST's GenAI Profile and AI RMF, NIST SP 800-218A and OWASP's agentic list all recommend deactivation mechanisms and the criteria for using them. In one reported case a coding agent deleted a production database during a code freeze declared to it, which a switch enforced by the runtime rather than by the agent would have held.

Class: operational integrity · set: operational integrity · maturity: reviewed · confidence: high · id guardrail.opint-deployment-off-switch-and-decommissioning