Operate / Day two

Emergency controls

Seven controls, each with a side-effect-free blast radius preview — and the one thing you must not do instead.

#The seven controls

#Preview first, always

bashCopy
curl -X POST $CP/v1/security/emergency/preview \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{ "kind": "REVOKE_AGENT", "target_id": "agt_01JAV…" }'

#Execute

bashCopy
curl -X POST $CP/v1/security/emergency/execute \
  -H "Authorization: Bearer $KEY" \
  -H 'content-type: application/json' \
  -d '{
    "kind": "PAUSE_AGENT",
    "target_id": "agt_01JAV…",
    "reason": "Refund volume 8x baseline with no corresponding claim volume",
    "incident_id": "inc_01JAV…",
    "confirm_blast_radius": true
  }'

Four requirements, all enforced:

security:emergency_actionpermissionrequired

High impact, so it cannot come from a wildcard grant. SECURITY_ADMIN holds it.

Step-up authenticationsession staterequired

A fresh re-authentication, regardless of session age.

reasonstring, min 10 charsrequired

Recorded. A one-word reason is rejected by length.

confirm_blast_radiustruerequired

Explicit confirmation that you reviewed the preview. Note the field name — it is confirm_blast_radius, not anything else, and a wrong name is a 400.

The blast radius is recomputed at execution time and stored with the record. So the evidence shows what was actually affected, not what a preview predicted some minutes earlier.

Every execution writes a CRITICAL audit event.

#Which control to reach for

#Something is wrong and I do not know what

PAUSE_ENVIRONMENT. Stops everything, reversibly, immediately. Then diagnose with time on your side.

Over-broad on purpose: stopping too much for ten minutes is cheaper than stopping the wrong thing while the right thing continues.

#One agent is misbehaving

PAUSE_AGENT. Reversible, immediate, narrow.

#One agent may be compromised

ISOLATE_AGENT. Broader than pause — it cuts existing sessions too, not just new actions. Use it when you think something is actively using the identity rather than the agent simply behaving oddly.

#The key is definitely compromised

REVOKE_AGENT. Terminal. No un-revoke. Register a new agent afterwards.

Preview it first; the cascade through delegations is usually larger than people expect.

#A secret has leaked

REVOKE_CREDENTIAL. Terminal for that credential, and every tool depending on it starts failing at stage 10.

If the downstream key is still good and you simply want new material, rotate instead — rotation also invalidates outstanding leases but keeps the tool working. See Credential leak.

#A tool is returning bad data

DISABLE_TOOL. Reversible, and it applies to every agent at once. Refused with TOOL_DISABLED, which is distinct from a policy BLOCK so your logs say which happened.

#Traffic is going somewhere it should not

BLOCK_DESTINATION. Reversible. Then fix the tools' destination allowlists, which is the durable fix.

#Reversing

Pause, isolate, disable and block all reverse through their normal lifecycle endpoints — resume, enable, unpause. Reversal is also audited.

Revocation does not reverse. That is the design: a revocation that can be undone by whoever caused the incident is not a revocation.

#Break-glass

Separate from the controls above, and a separate permission.

bashCopy
curl -s $CP/v1/security/break-glass -H "Authorization: Bearer $KEY"

security:break_glass grants emergency elevated access. It is high impact, step-up gated, writes CRITICAL audit events, and every use is listed.

#Practise

Walk a runbook against staging, quarterly. Pick one and actually do it.

A runbook nobody has executed is a document, not a capability — and the thing you discover in a real incident is never the step you thought would be hard. Usually it is that nobody has the permission, or nobody knows the agent id.

#Related