Agentic applications start further agents, which in turn call tools. According to Dr. Eldar Sultanow in the iX Magazine (heise online), a kill switch that shuts the whole system down is not so easy to build.
Why process IDs are not enough
According to the article, agents are not processes. The operating system assigns process IDs dynamically at runtime, and the set of running agents is a moving target. Trying to stop agents via PIDs is therefore described as the least reliable way to slow them down.
Stopping is not undoing
The article states that ending a process is different from stopping an agent. If an agent has already initiated a payment, started an external program, sent an email or sent a DELETE command to a REST API, a SIGKILL does not reverse this.
Layered approach
According to the article, five layers work together: cgroups, network and access revocation, an enforcement point for permissions, an authoritative control plane and short-lived permission tokens. Agents can be stopped by revoking their permissions or by terminating when no signal arrives.
Assessment
The architecture described, according to the article, can only guarantee that agents wind down after a limited time, not offer an immediate off switch. For companies deploying AI agents with write access to payment or data systems, this could mean that permission and time-limit concepts need to be planned earlier than emergency shutdowns. The article leaves open how already triggered actions can be reversed in practice.
Sources
Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.
