[{"data":1,"prerenderedAt":28},["ShallowReactive",2],{"nr-en-kill-switch-architecture-for-ai-applications":3},{"slug":4,"title":5,"dek":6,"date":7,"time":8,"publishedAt":9,"updated":10,"updatedAt":10,"dateFmt":11,"updatedFmt":10,"kind":12,"tier":13,"author":14,"authorName":15,"topics":16,"tracker":21,"trackerLabel":22,"headlineStat":10,"image":23,"ogImage":24,"imageAlt":5,"csv":10,"minutes":25,"words":26,"html":27},"kill-switch-architecture-for-ai-applications","Kill-switch architecture for AI applications: why a single switch is not enough","An iX article explains why agentic AI systems cannot be shut down via process IDs and which layered approaches are possible instead.","2026-10-16","07:44","2026-10-16T07:44:00+02:00","","October 16, 2026","analyse","standard","ideal-syka","Ideal Syka",[17,18,19,20],"AI security","Agents","Architecture","Access rights","\u002Fki-status","Live AI service outages","\u002Fnewsroom\u002Fimg\u002Fkill-switch-architecture-for-ai-applications.webp","\u002Fog-nr\u002Fkill-switch-architecture-for-ai-applications.en.png",1,269,"\u003Cp>Agentic applications start further agents, which in turn call tools. According to Dr. Eldar Sultanow in the iX Magazine (heise online), a kill switch that shuts the whole system down is not so easy to build.\u003C\u002Fp>\n\u003Ch2>Why process IDs are not enough\u003C\u002Fh2>\n\u003Cp>According to the article, agents are not processes. The operating system assigns process IDs dynamically at runtime, and the set of running agents is a moving target. Trying to stop agents via PIDs is therefore described as the least reliable way to slow them down.\u003C\u002Fp>\n\u003Ch2>Stopping is not undoing\u003C\u002Fh2>\n\u003Cp>The article states that ending a process is different from stopping an agent. If an agent has already initiated a payment, started an external program, sent an email or sent a DELETE command to a REST API, a SIGKILL does not reverse this.\u003C\u002Fp>\n\u003Ch2>Layered approach\u003C\u002Fh2>\n\u003Cp>According to the article, five layers work together: cgroups, network and access revocation, an enforcement point for permissions, an authoritative control plane and short-lived permission tokens. Agents can be stopped by revoking their permissions or by terminating when no signal arrives.\u003C\u002Fp>\n\u003Ch2>Assessment\u003C\u002Fh2>\n\u003Cp>The architecture described, according to the article, can only guarantee that agents wind down after a limited time, not offer an immediate off switch. For companies deploying AI agents with write access to payment or data systems, this could mean that permission and time-limit concepts need to be planned earlier than emergency shutdowns. The article leaves open how already triggered actions can be reversed in practice.\u003C\u002Fp>\n\u003Ch2>Sources\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>\u003Ca href=\"https:\u002F\u002Fwww.heise.de\u002Fhintergrund\u002FSo-funktioniert-Kill-Switch-Architektur-fuer-KI-Anwendungen-11487391.html\">heise online\u003C\u002Fa>\u003C\u002Fli>\n\u003C\u002Ful>\n\u003Cp>\u003Cem>Editorially owned by \u003Ca href=\"\u002Fen\u002Fautor\u002Fideal-syka\">Ideal Syka\u003C\u002Fa>. Sources and method: \u003Ca href=\"\u002Fen\u002Fredaktion\">Newsroom & method\u003C\u002Fa>. Tips and corrections: \u003Ca href=\"mailto:ai@i6eal.de\">ai@i6eal.de\u003C\u002Fa>.\u003C\u002Fem>\u003C\u002Fp>\n",1792135279319]