Kill switch your agent can pull

We trusted agents to code, but we still trusted ourselves to spot when to say stop.

That was the mistake.

What we wired in last week:

1. Agent can pull its own kill switch:

- Runtime call → PUT /api/admin/killswitches/{id}/switch {env, switchKey, value}

- Per-env, versioned, audit-trailed. Flag flips without deploy.

- DELETE /api/admin/killswitches/{id}/switch removes override.

2. Same path for human:

- UI toggle or API — same versioning, same eval path.

- Gateway evaluates in <5ms, typed SDK getters everywhere.

3. What it buys you:

- Agent trips bad path in prod → it flips switch → bad path disabled instantly → incident stays mitigation-sized, not page-sized.

- Human reviews PR for full fix next.

Setup: same queue, same SDK. One extra scope param.

How are you letting agents self-mitigate? We'd love wiring diagrams.

→ shipeasy.ai / docs.shipeasy.ai