Incident response — kill switch

The kill switch has four levels. Each stops a progressively wider scope, and each is a ledger event.

The four levels#

Level	Stops	Use when
Agent	One agent instance: no new steps for that agent	A single agent is misbehaving
Graph	All runs of one graph version	A graph is producing wrong outcomes
Workspace	All runs in a workspace	A workspace is under active incident
Org	All runs across the tenant	Full stop

Triggering#

Workspace → Incident → Kill switch. Choose the level. The kill takes effect at the next step boundary — a step already mid-execution completes or is denied per policy; nothing new starts.

orkena kill --level graph --graph refund-approval --reason "SOC-2026-042"

What gets recorded#

The kill is a ledger event with the operator, the level, the reason and the timestamp. Everything before the kill remains in the chain — evidence for the post-incident review. Everything after is denied or routed to a human.

Recovery#

1. Investigate using deterministic replay and evidence bundles for the affected runs.
2. Fix the graph or policy; promote through the eval gate.
3. Resume runs from the last valid checkpoint, or start fresh — the ledger tells you exactly what state each run was in.

DR posture#

In the managed tier (roadmap, 2027), the kill switch is available via the API and UI; in VPC and air-gap modes it is fully local. The durable executor means a kill never loses state — runs pause at checkpoints and resume or are retired deliberately.