---
title: Emergency controls
description: Seven controls, each with a side-effect-free blast radius preview — and the one thing you must not do instead.
---

:::danger Pause. Do not drop the enforcement mode.
Under pressure the instinct is to put the environment back in `OBSERVE`. That is
the **worst** available option: it stops refusing anything while leaving
everything running, so a misbehaving agent gets a free pass at exactly the
moment you were trying to stop it.

Use the controls on this page. They exist for this.
:::

## The seven controls

| Kind | Target | Reversible | Stops |
| --- | --- | --- | --- |
| `PAUSE_AGENT` | an agent | yes | New protected actions by that agent |
| `ISOLATE_AGENT` | an agent | yes | Everything the agent can do, including sessions |
| `REVOKE_AGENT` | an agent | **no** | The identity, permanently |
| `REVOKE_CREDENTIAL` | a credential | **no** | Every tool depending on it |
| `DISABLE_TOOL` | a tool | yes | That tool, for every agent |
| `BLOCK_DESTINATION` | a host | yes | Egress to that host |
| `PAUSE_ENVIRONMENT` | an environment | yes | All protected execution in it |

## Preview first, always

```bash
curl -X POST $CP/v1/security/emergency/preview \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{ "kind": "REVOKE_AGENT", "target_id": "agt_01JAV…" }'
```

:::security The preview has no side effects
It tells you what the control would affect: sessions that die, delegations that
cascade, approvals that are abandoned, tools that become unreachable, agents
that stop working.

It exists so nobody finds out what a control does by using it. The console
**requires** the preview to be rendered before it will let you confirm.
:::

## Execute

```bash
curl -X POST $CP/v1/security/emergency/execute \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{
    "kind": "PAUSE_AGENT",
    "target_id": "agt_01JAV…",
    "reason": "Refund volume 8x baseline with no corresponding claim volume",
    "incident_id": "inc_01JAV…",
    "confirm_blast_radius": true
  }'
```

Four requirements, all enforced:

:::params

:::param security:emergency_action | permission | required
High impact, so it cannot come from a wildcard grant. `SECURITY_ADMIN` holds it.
:::

:::param Step-up authentication | session state | required
A fresh re-authentication, regardless of session age.
:::

:::param reason | string, min 10 chars | required
Recorded. A one-word reason is rejected by length.
:::

:::param confirm_blast_radius | true | required
Explicit confirmation that you reviewed the preview. Note the field name — it is
`confirm_blast_radius`, not anything else, and a wrong name is a `400`.
:::

:::

The blast radius is **recomputed at execution time** and stored with the record.
So the evidence shows what was actually affected, not what a preview predicted
some minutes earlier.

Every execution writes a `CRITICAL` audit event.

## Which control to reach for

### Something is wrong and I do not know what

`PAUSE_ENVIRONMENT`. Stops everything, reversibly, immediately. Then diagnose
with time on your side.

Over-broad on purpose: stopping too much for ten minutes is cheaper than
stopping the wrong thing while the right thing continues.

### One agent is misbehaving

`PAUSE_AGENT`. Reversible, immediate, narrow.

### One agent may be compromised

`ISOLATE_AGENT`. Broader than pause — it cuts existing sessions too, not just
new actions. Use it when you think something is *actively* using the identity
rather than the agent simply behaving oddly.

### The key is definitely compromised

`REVOKE_AGENT`. **Terminal.** No un-revoke. Register a new agent afterwards.

Preview it first; the cascade through delegations is usually larger than people
expect.

### A secret has leaked

`REVOKE_CREDENTIAL`. Terminal for that credential, and every tool depending on
it starts failing at stage 10.

If the downstream key is still good and you simply want new material, **rotate
instead** — rotation also invalidates outstanding leases but keeps the tool
working. See [Credential leak](/operate/runbook-credential-leak).

### A tool is returning bad data

`DISABLE_TOOL`. Reversible, and it applies to every agent at once. Refused with
`TOOL_DISABLED`, which is distinct from a policy `BLOCK` so your logs say which
happened.

### Traffic is going somewhere it should not

`BLOCK_DESTINATION`. Reversible. Then fix the tools' destination allowlists,
which is the durable fix.

## Reversing

Pause, isolate, disable and block all reverse through their normal lifecycle
endpoints — `resume`, `enable`, `unpause`. Reversal is also audited.

Revocation does not reverse. That is the design: a revocation that can be undone
by whoever caused the incident is not a revocation.

## Break-glass

Separate from the controls above, and a separate permission.

```bash
curl -s $CP/v1/security/break-glass -H "Authorization: Bearer $KEY"
```

`security:break_glass` grants emergency elevated access. It is high impact,
step-up gated, writes `CRITICAL` audit events, and every use is listed.

:::security Grant break-glass to as few people as possible, and review every use
Its whole purpose is to be the thing you notice. A break-glass grant held by
half the team is not an emergency mechanism, it is a standing privilege with a
dramatic name.

Review the list monthly. Every entry should correspond to an incident somebody
remembers.
:::

## Practise

Walk a runbook against staging, quarterly. Pick one and actually do it.

A runbook nobody has executed is a document, not a capability — and the thing
you discover in a real incident is never the step you thought would be hard.
Usually it is that nobody has the permission, or nobody knows the agent id.

| | |
| --- | --- |
| [Compromised agent](/operate/runbook-compromised-agent) | Containment through revocation |
| [Credential leak](/operate/runbook-credential-leak) | Rotation under pressure |
| [Policy rollback](/operate/runbook-policy-rollback) | Reverting a bad activation |
| [Dependency outage](/operate/runbook-dependency-outage) | Fail-closed behaviour |

## Related

:::cards

:::card Incidents | /operate/incidents
Record the investigation, let policy react.
:::

:::card Security API | /reference/api/security
Preview, execute, incidents.
:::

:::card Step-up | /secure/step-up
Why these need re-authentication.
:::

:::card Console tour | /operate/console-tour
Where the controls live in the UI.
:::

:::