Kill switch & rollback
When an agent misbehaves, two things matter: how fast you can stop it, and how well you can prove what you did. The kill switch stops a model or agent through the same decision door as every other decision on the platform. A named person decides, the action executes, and the whole event seals on the hash-chained ledger. Rollback restores the last approved version with its change trail intact.
One decision stops a model or agent: a named person acts through the one decision door, and the stop executes.
Rollback restores the last approved version of the model, prompt, or policy, with the change trail intact.
Stop proposals are raised by monitoring breaches and drift findings. Agents propose the stop, and a human decides.
The platform fails closed by design: if it cannot verify an agent's standing, meaning a current evaluation, trust score, and policy binding, serving stops rather than continuing on assumption.
The stop, the reason, the decider, and the restore are all sealed on the ledger, ready to drop into an evidence pack.
Restart goes through the same door, with the required evidence current and the approval on the record, so there is no quiet re-enable.
Propose
A monitoring breach, a drift finding, or a person raises the stop. Agents propose, and humans decide.
Decide
A named person approves through the one decision door, and the decision and its seal land together or the action does not proceed.
Execute
The agent stops serving or rolls back to the last approved version, and the platform confirms the state change with evidence.
Restore
Restart goes back through the same door, with current evidence in place and the approval sealed.
“If this agent goes wrong at 2am, who can stop it and how fast?”
A named person stops it with one decision through the one decision door, and the stop executes immediately. Monitoring breaches and drift findings can raise the stop proposal automatically, so the decision is already framed when the person acts.
“Can you prove it was actually off, and when?”
Yes. The platform confirms the state change with evidence, and the stop, the reason, the decider, and the timestamp are all sealed on the hash-chained ledger, ready to drop into an evidence pack.
“Who signed off on turning it back on?”
Restart goes back through the same decision door, with the required evidence current and a named approver on the record. The approval is sealed on the ledger, so there is no quiet re-enable.
Start with proof, not a promise.
There are three ways in, and each one earns the next. You approve the exit criteria before we spend any more of your time or budget.
A 60-minute working session
Bring one report that is expensive to prove. We walk the mechanism against it. Nothing is required from your side.
A two-week guided sandbox
Your team works hands-on against a synthetic sample bank. It requires zero access to your systems and zero procurement.
A six-week proof on your systems
We use read-only metadata across five systems and one priority report, scored against criteria both sides sign first. The decision it produces is yours.