Glossary / Kill Switch

Kill Switch

An out-of-band control that stops an automated system from acting, reachable even when the system it stops is behaving badly.

A kill switch exists for the case where automation is doing exactly what it was told and that turns out to be wrong — a runaway sequence, a misconfigured rule, an AI agent operating on bad inputs. It differs from a pause button in the interface in one specific way: it has to work when the normal path is the thing that is broken.

That is why the useful test of a kill switch is where it is enforced, not where it appears. A control rendered in the interface stops a well-behaved client. A control enforced at the server, checked on every action before the action is taken, stops the system itself — including a compromised or malfunctioning client that never renders the interface at all.

The second test is whether the switch is reachable under the conditions that would require it. A kill switch that lives inside the system it disables, and depends on that system being healthy enough to log in to, is a control that works in every scenario except the one it exists for.

How Nexus handles this

Nexus enforces its autonomous-send kill switch at the server boundary alongside opt-out, suppression, and a per-tenant rate limit — the interface control is convenience, and the server check is the actual gate.

Ready to see it in the platform?

Join the design-partner cohort and we'll show you exactly where this lives.