Agent Controls
Kill an agent to block its tool calls immediately, or revoke it to disable it in the registry.
Every agent's detail page has a Controls tab with two independent ways to stop an agent: an immediate kill switch that blocks tool calls at enforcement time, and a Revoke action that disables the agent in the registry.
Kill and revoke are separate mechanisms with different effects. Killing an agent blocks its tool calls without changing its registry status. Revoking an agent sets its registry status to inactive; it does not use the kill-switch table at all.
Kill switch
The Controls tab shows a status card for the agent's current kill state:
- If the agent is not killed, you can kill it for a preset duration - 1 minute, 5 minutes, 30 minutes, or Indefinite - or enter a custom number of minutes. There is no confirmation dialog; clicking Kill takes effect immediately.
- If the agent is killed, the card shows a countdown to the expiry time (or "Active until manually lifted" for an indefinite kill) and a Lift kill button that clears it immediately, also without a confirmation dialog.
Killing an agent calls POST /iap/agent/:agentId/kill with an optional durationSeconds and reason; lifting it calls POST /iap/agent/:agentId/unkill. The dashboard currently sends a fixed reason string rather than a free-text reason you enter.
What killing an agent actually does
A kill is checked before policy and OPA evaluation on every tool call the agent makes through the IAP enforcement pipeline. While a kill is active:
- every tool call for that agent is blocked with
enforcementAction: blockandreason: agent_killed, regardless of what any policy would otherwise allow; - the block is recorded as an IAP audit-log entry and an enforcement activity event.
A kill can be timed (it clears itself once expiresAt passes) or indefinite (expiresAt is null, and it stays active until an operator lifts it). Lifting a kill only records the timestamp it was cleared - it does not record who cleared it.
List every currently active kill for your organization with GET /iap/agent-kills.
Revoke
Revoke, on the agent's header, is a different action: it sets the agent's registry status to inactive through POST /agent/agents/:agentId/status. A revoked agent stays in the registry and can be brought back with Re-enable, which sets status back to active. Unlike a kill, revoke has no timer or expiry - it stays in effect until you re-enable the agent, and it shows a confirmation dialog before applying.
Use revoke when you want an agent disabled indefinitely as part of normal lifecycle management. Use kill when you need to immediately and verifiably stop an agent's tool calls at the enforcement layer, optionally for a bounded window.