Skip to main content

​
Kill switch

The organization kill switch is an emergency governance control. When active, it denies governed backend requests for that organization before normal policy mode is applied. It does not remotely stop arbitrary customer code that never calls Arclasp.

​
What it stops

For an application that routes a consequential action through record_agent_action():
  1. the SDK sends the governed event to Arclasp;
  2. the backend checks the organization kill-switch state;
  3. if active, the governed action is denied;
  4. the SDK raises ArclaspKillSwitchError;
  5. the customer application should not execute the protected side effect.
An in-flight workflow is therefore stopped at its next Arclasp-governed boundary, not by remotely terminating the customer process.

​
What it does not stop

The kill switch does not:
  • kill a Python process;
  • cancel arbitrary threads or tasks in your application;
  • revoke third-party credentials by itself;
  • stop code that bypasses Arclasp;
  • undo side effects that already happened;
  • guarantee that every agent in your infrastructure is inactive.
That is why consequential actions must actually be instrumented through the governance boundary if you expect the kill switch to control them.

​
Activate and resume

Authorized organization users can use the dashboard’s kill-switch controls to pause and later resume governed activity. The kill switch is organization-scoped. It is not a per-Agent or per-Chain pause control.

​
SDK handling

Treat this error as an instruction to stop the governed workflow. Do not catch it and deliberately run the protected customer-side action anyway.

​
Priority

The kill switch is checked before ordinary policy mode. A policy set to shadow or disabled does not bypass an active organization kill switch. A scoped PolicyException does not bypass it either.

​
Receipts during a halt

Do not assume that a kill-switch denial automatically creates a completed or special-case receipt. Receipts are created through the valid Chain-completion path. If a Chain does not complete successfully, application code should not invent or assume a completed receipt exists.

​
Narrower controls

If you need to stop one workflow or one customer-side agent rather than the organization-wide governed surface, use the application’s own lifecycle controls and the relevant Arclasp policy/agent configuration. The kill switch is deliberately broad across the organization’s governed actions.