> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bloomtechnologies.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Kill Switch

> Immediately halt a compromised or misbehaving agent

## Overview

The Kill Switch is an emergency mechanism to immediately terminate an agent's access to all external services. When activated:

1. All in-flight requests are terminated
2. The agent's credentials are revoked
3. Future requests are blocked
4. Webhooks are triggered (if configured)

**Propagation time: \< 100ms globally**

## Activation Methods

### Dashboard (Recommended)

1. Go to **Agents** in the dashboard
2. Find the agent you want to kill
3. Click the red **Kill** button
4. Confirm the action

The agent status will change to "killed" and all requests will be blocked.

### API

```bash theme={null}
curl -X POST https://iam.bloomtechnologies.app/admin/agents/{agent_id}/kill \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "reason": "Anomalous behavior detected",
    "notify": ["webhook"]
  }'
```

**Response:**

```json theme={null}
{
  "status": "killed",
  "agent_id": "agent_abc123",
  "killed_at": "2026-02-01T15:30:00Z",
  "credentials_revoked": 3,
  "in_flight_requests_terminated": 2,
  "propagation_ms": 47
}
```

### SDK (Python)

```python theme={null}
from bloom_admin import BloomAdmin

admin = BloomAdmin(api_key=os.environ["BLOOM_ADMIN_TOKEN"])
result = admin.kill_agent(
    agent_id="agent_abc123",
    reason="Security concern"
)
print(f"Agent killed in {result['propagation_ms']}ms")
```

## Reactivating an Agent

After investigating and resolving the issue, you can reactivate an agent:

### Dashboard

1. Go to **Agents**
2. Find the killed agent (shown in red)
3. Click **Reactivate**
4. Confirm the action

### API

```bash theme={null}
curl -X POST https://iam.bloomtechnologies.app/admin/agents/{agent_id}/reactivate \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"reason": "Issue resolved after investigation"}'
```

## Automatic Kill Triggers

Configure automatic kill switch activation based on:

### Anomaly Detection

```yaml theme={null}
# In scope settings
anomaly_detection:
  enabled: true
  auto_kill_threshold: 0.95  # Kill if anomaly score > 95%
```

### Rate Limiting

```yaml theme={null}
rate_limiting:
  requests_per_minute: 100
  auto_kill_on_sustained_violation: true
  violation_window_minutes: 5
```

### Injection Detection

```yaml theme={null}
injection_detection:
  mode: "block"
  auto_kill_on_critical: true  # Kill on critical injection attempts
```

## Webhooks

Get notified when an agent is killed:

1. Go to **Activity > Webhooks**
2. Add a webhook endpoint
3. Select the `agent_killed` event

**Webhook Payload:**

```json theme={null}
{
  "event": "agent_killed",
  "timestamp": "2026-02-01T15:30:00Z",
  "agent_id": "agent_abc123",
  "agent_name": "my-agent",
  "reason": "Manual kill by admin",
  "triggered_by": "user@example.com",
  "metadata": {
    "last_request": "/v1/chat/completions",
    "requests_last_hour": 1547
  }
}
```

## Best Practices

<CardGroup cols={2}>
  <Card title="Monitor Before Killing" icon="eye">
    Review audit logs before killing to understand what the agent was doing
  </Card>

  <Card title="Document the Reason" icon="file-lines">
    Always provide a reason when killing - it helps with post-incident analysis
  </Card>

  <Card title="Set Up Webhooks" icon="bell">
    Configure webhooks to alert your team when agents are killed
  </Card>

  <Card title="Test in Staging" icon="flask">
    Test your kill switch response in staging before production incidents
  </Card>
</CardGroup>

## FAQ

<AccordionGroup>
  <Accordion title="How fast does the kill switch propagate?">
    The kill switch propagates globally in under 100ms. All edge locations receive the kill signal within this time.
  </Accordion>

  <Accordion title="What happens to in-flight requests?">
    In-flight requests are terminated with a 503 Service Unavailable response. The client will receive an error indicating the agent has been killed.
  </Accordion>

  <Accordion title="Can I undo a kill?">
    Yes, you can reactivate an agent from the dashboard or API. However, you should investigate the reason for the kill before reactivating.
  </Accordion>

  <Accordion title="Are logs preserved when an agent is killed?">
    Yes, all audit logs are preserved. You can review what the agent was doing before and after the kill.
  </Accordion>
</AccordionGroup>