Govern
Kill & break-glass
Stop the blast radius fast — and temporarily bypass policy when a human explicitly owns the risk.
What it is
Kill / pause switches block enqueue (and can cancel in-flight runs) for a tenant or agent. Break-glass is a time-bounded window that bypasses policy Decide — not auth, not kill, not rate limits.
Why it is here
Incidents need a single choke point. Per-script SIGTERM does not scale across frameworks and replicas.
How to use it
- Admin → Kill — upsert a kill or pause for tenant/agent; confirm in-flight cancel behavior.
- Clear the switch when the incident is over so enqueue resumes.
- Break-glass — create a window with reason + expiry (max 24h); revoke early if possible.
- Review Audit afterward — break-glass is meant to be loud and temporary.
In the product
Admin → Kill — refuse new creates; optional drain of in-flight runs
Admin → Break-glass — time-bounded policy bypass (max 24h)
What to expect
- Kill — new work stops; optional cancel of non-terminal runs in scope.
- Break-glass — policy allows that would otherwise pending/deny may proceed; kill still wins.
- SQL only — these Admin routes return 501 on Mongo for governance durability.
- Full step-by-step — see Admin UI guide → Kill switches and Break-glass for a detailed walkthrough of each screen.
Reference: docs/admin.md · docs/trust-governance.md · Ops