Why not shut everything down at once?

Because shutting down costs operation and can destroy evidence or leave half-finished transactions. The lowest rung that stops the harm is usually faster and keeps the state you need for restoration.

Can a containment step create a hazard?

In OT and on machines, yes, if cutting an agent off leaves a process without control. That is why the process must always be controllable without the agent, and why containment is planned with the plant’s operations.

Is the AI Act’s stop button an emergency stop?

No. Article 14(4)(e) concerns interrupting a high-risk AI system. Emergency stops of machines are governed by machinery law and standards such as ISO 13850.

All context cards

Context card

Containing an AI agent: pause, revoke, isolate, shut down

How do you stop an AI agent that has crossed its boundary — without making things worse, and without confusing it with stopping a machine?

By knowledge.aitechdoc.world

Reviewed 21 October 2026

Review log and changes

The short answer

Containment is a ladder of four rungs that act from outside the agent: pause the task, revoke its credentials, isolate its tools and connected systems, shut it down. The lowest rung that stops the harm is chosen, and the evidence is secured first. Containing an agent never replaces the stopping functions of a machine: a robot, a line or a process is brought to a safe state by its own control system.

For: Technical project managers, operations teams, documentation systems developers and technical writers who write runbooks

Key points

Containment acts from outside the agent; a stop the agent can ignore is no stop.
Four rungs: pause, revoke, isolate, shut down — choose the lowest one that stops the harm.
Contain the effects too: queued updates, open transactions and running orders keep acting.
Secure the traces and affected records before anyone cleans up.
An agent stop is not an emergency stop; the AI Act’s stop procedure and machine safety exist side by side.

The context

The ladder

Pause the task or the agent — no new steps, the state is kept.
Revoke its credentials: tokens, keys, sessions. With a separate agent identity, the people it worked for keep their access.
Isolate its tools and connected systems: disconnect a connector, set an interface to manual, halt a queue, quarantine a device group, cut the conduit into OT.
Shut down the agent or the agent platform.

An agent kill switch bundles rungs 1 to 3 for one agent, a group or all agents. Every rung must be tested before it is needed, and every use is recorded. The blast radius tells you how fast you have to climb.

Contain the effects, not only the agent

System type	Effects that keep acting	Containment of the effect
IT	Open transactions, queued mails, running pipelines	Freeze queues, hold the pipeline, block the connector
IoT	Rollout waves, scheduled commands	Halt the rollout queue, isolate the device group at the gateway or in the device cloud
OT	Written setpoints and recipes, running batches	Close the conduit, fall back to operator control, check the values against the released ones
Machines	Changed programmes and parameters, orders to fleet managers	Stop sending orders; the machine or vehicle finishes or stops under its own control

Agent stop vs. emergency stop

The AI Act requires that people overseeing a high-risk AI system can interrupt it through a “stop” button or a similar procedure that brings it to a halt in a safe state (Art. 14(4)(e)). That stop concerns the AI system. An emergency stop is a safety function of a machine, designed and validated under machinery law, and the machine’s safe state is reached by its own control and safety systems — for example with a controlled stop. Where an agent works with a robot cell, an AMR fleet or a line, both exist side by side: the agent stop never replaces the emergency stop, and the emergency stop never depends on the agent.

Who decides

Name in advance who may take which rung, and how quickly — rung 1 often the operator of the agent, rung 4 the owner of the platform. In OT, cutting the conduit is agreed with the plant’s operations, because the process must stay controlled without the agent.

The whole picture is on the pathway map on AI agents crossing the line.

Questions readers ask next

Why not shut everything down at once?: Because shutting down costs operation and can destroy evidence or leave half-finished transactions. The lowest rung that stops the harm is usually faster and keeps the state you need for restoration.
Can a containment step create a hazard?: In OT and on machines, yes, if cutting an agent off leaves a process without control. That is why the process must always be controllable without the agent, and why containment is planned with the plant’s operations.
Is the AI Act’s stop button an emergency stop?: No. Article 14(4)(e) concerns interrupting a high-risk AI system. Emergency stops of machines are governed by machinery law and standards such as ISO 13850.

Sources

NIST SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management — NIST, 3 April 2025
OWASP Top 10 for Agentic Applications for 2026 — OWASP GenAI Security Project, 9 December 2025
Regulation (EU) 2024/1689 (Artificial Intelligence Act) — EUR-Lex, 12 July 2024
Regulation (EU) 2023/1230 (Machinery Regulation) — EUR-Lex, 29 June 2023
RFC 7009: OAuth 2.0 Token Revocation — IETF, August 2013

Review log and changes

Every context card is checked against its sources before it is published, and again whenever it changes; the date under the byline is the last review. Corrections (something was wrong) and additions (something was missing) are logged below with date and time (Berlin time). Typos, formatting and link fixes are not listed.

Reviewed 21 October 2026

No corrections or additions since publication.

Glossary terms on this card

Agent containment
Agent containment is the set of graded measures that stop an AI agent from causing further harm after it has crossed or may have crossed its boundary — pausing it, revoking its access, isolating its tools and connected systems, and shutting it down — while preserving the evidence needed to understand what happened.
Agent kill switch
An agent kill switch is a control outside the AI agent that stops one agent, a group of agents or all agents of a platform at once — ending running tasks, blocking new tool calls and revoking or suspending their access — without needing the agent’s cooperation.
Credential revocation
Credential revocation is the act of invalidating a credential — a password, API key, access token, certificate or session — before it would expire, so that a user, service, device or AI agent can no longer use it to access a system.
Stop button or similar procedure (AI Act)
Under Article 14(4)(e) of the EU AI Act, the human oversight measures of a high-risk AI system must enable the people assigned to oversight to intervene in its operation or interrupt it through a “stop” button or a similar procedure that allows the system to come to a halt in a safe state.
Emergency stop
In machine safety, an emergency stop is a complementary protective function intended to avert or reduce existing or impending hazards by stopping hazardous operation. It is initiated by a single human action and is not a substitute for safeguards or other protective measures.
Safe state
In machine safety and functional safety, a safe state is a condition in which risk has been reduced to an acceptable level for the relevant situation. What counts as safe depends on the machine, the hazard and the task being performed.
Zone and conduit model
In IEC 62443, the zone and conduit model is the method of partitioning an industrial automation and control system into security zones, groups of assets with common security requirements, and conduits, the controlled communication paths between them, so that each zone and conduit can be assigned a target security level and appropriate countermeasures.
Network segmentation
In OT security, network segmentation is the division of a network into separate segments or zones with controlled communication between them, so that traffic and the spread of attacks or faults are limited. IEC 62443-3-2 describes it as partitioning a system into zones and conduits.
Blast radius (AI agent)
The blast radius of an AI agent is the full set of systems, data, devices, physical processes and people that one wrong or manipulated action of the agent could affect before it is stopped — determined by its permissions, its connections, the speed at which it acts and what other agents or systems act on its output.
Controlled stop
In IEC 60204-1, a controlled stop is the stopping of machine motion by reducing the command signal to zero once the stop signal has been recognized by the control, while power to the machine actuators is retained during the stopping process.