The button no one tested

Every agentic operation needs two stops: one a person triggers, and another that triggers on its own.

The automatic one is the circuit breaker, which stops the operation when average cost doubles, the error rate rises, or latency blows past the limit. It exists because the anomaly usually happens at three in the morning on a Saturday.

The manual one is the kill switch, and this is where almost everyone skips a step: a button that has never been pressed is just an assumption. Test it in training the same day you build it, and again every quarter. During an incident is the worst time to discover the command does not work.

The audit trail completes the set: who decided what, when, and based on what. With it, the organization can respond to an external inquiry in minutes, not days, and can say “we know exactly what happened and why” instead of “the system made a mistake.”