Who can stop your AI?
This is the question every organisation sholuld be asking
Before giving an AI permission to act on your behalf, ask one question:
If it starts doing something harmful, who can stop it and how?
CrowdStrike’s announcement last week brings this question into focus. They describe an AI Kill Switch initially operating through its gateway, with endpoint capabilities to follow. The aim is to give authorised defenders the ability to interrupt unauthorised agent activity and prevent it from continuing.
For business leaders, the wider message is clear: the ability to intervene needs to be designed into AI adoption from the outset.
When AI can act, oversight must be practical
If you are using an AI assistant to draft a document, that presents a different risk from allowing an agent to send emails, change records, access customer information or trigger transactions. Much bigger risk.
As we authorise more permission and access, the consequences of mistakes, misuse or unexpected behaviour increase.
Consider what it would mean if an AI agent sends confidential information to the wrong recipient. Or an automated workflow repeatedly makes an incorrect change across hundreds of records.
Someone needs to recognise the problem, have authority to intervene and know how to contain it.
Human oversight / Human in the Loop (HITL) must work in practice.
What our kill switch policies are intended to achieve
At The TrustBridge, our approach to kill switch policies centres on clear responsibilities and workable intervention.
A policy needs to address six questions:
1. What should trigger intervention?Examples could include unexpected data access, actions outside the approved purpose, repeated errors, unusual spending or a suspected security incident.
2. Who has authority to act?Name the responsible roles and the circumstances in which immediate suspension is authorised. Avoid an approval process that leaves harmful activity running until approval is granted.
3. How will activity be stopped?Depending on the system, this could mean pausing a workflow, disabling an integration, revoking credentials or asking a supplier to suspend access. The mechanism must match the technology.
4. What happens to connected processes?Stopping one agent may leave queued tasks, connected services or downstream actions running. The response must account for those dependencies and provide a safe operational fallback.
5. What evidence will be preserved?Keep appropriate logs and decision records so the organisation can investigate what happened and assess the impact.
6. Who can authorise a restart?Restart should only follow investigation, corrective action and proportionate testing, with an accountable person approving the decision.
A shutdown cannot undo an email already sent or information already disclosed. Prevention, limited permissions and monitoring remain essential.
Where AI Trust Assure™ fits
The AI Trust Assure™ assessment helps organisations examine how they govern AI, identify gaps and prioritise improvements.
Our approach considers AI usage and responsibilities, risk, workflows, data boundaries, supplier dependencies and human oversight. It asks organisations to look beyond having a policy and consider how their arrangements operate.
For intervention and shutdown, useful questions include:
Do we know which AI systems can take action?
Have we defined the limits of their authority?
Can we detect when those limits are exceeded?
Can an authorised person suspend activity promptly?
Have we tested the process, including supplier involvement?
What must happen before the system can restart?
The assessment supports stronger governance and audit readiness. Its value lies in helping organisations understand their exposure and take practical action.
Confidence comes from knowing you remain in control
AI can deliver substantial benefits. Clear boundaries and tested intervention procedures help organisations pursue those benefits with greater confidence.
Before expanding an AI system’s access or autonomy, make sure your organisation can answer:
Who can stop it, how quickly, and what happens next?
To explore your organisation’s position, speak to The TrustBridge about the AI Trust Assure™ assessment and our support with AI governance and kill switch policies.
Comments