Incident Pipeline and Kill Switch

Incident Pipeline and Kill Switch A workflow diagram generated by Archify. EX / Kill Switch (Layer 04) 02 / Runtime Signals 03 / Incident Pipeline 04 / Report & Evidence (Layer 05) 05 / Regulator Detect Contain + triage Report + evidence Kill switch: revoke per agent Art. 72 / 73 obligation Scheduled Drill · drilled monthly · Kill Switch (Layer 04) › Kill switch: revoke per agent › Detect Scheduled Drill drilled monthly Circuit Breaker · tool-call boundary · Kill Switch (Layer 04) › Kill switch: revoke per agent › Contain + triage · auto or manual Circuit Breaker tool-call boundary auto or manual Revoke Scope · halt tool calls · Kill Switch (Layer 04) › Kill switch: revoke per agent › Contain + triage Revoke Scope halt tool calls Fleet Runs On · rest unaffected · Kill Switch (Layer 04) › Kill switch: revoke per agent › Report + evidence Fleet Runs On rest unaffected Runtime Signal · agent tool call · Runtime Signals › Detect Runtime Signal agent tool call Detection · obs + guardrails · Runtime Signals › Detect Detection obs + guardrails Triage · classify severity · Incident Pipeline › Contain + triage Triage classify severity Reportable? · severity criteria · Incident Pipeline › Contain + triage Reportable? severity criteria Open Incident · Art. 73 timer · Incident Pipeline › Report + evidence Open Incident Art. 73 timer Draft Report · against template · Report & Evidence (Layer 05) › Art. 72 / 73 obligation › Report + evidence Draft Report against template Incident Record · machine-readable · Report & Evidence (Layer 05) › Art. 72 / 73 obligation › Report + evidence Incident Record machine-readable Notify Regulator · legal window · Regulator › Report + evidence Notify Regulator legal window revoke scope reportable auto-trip raise drill pre-fill on the clock as evidence flag severity Legend Agent logic Policy Tool action Context / trace Cloud service External system

Autonomy is withdrawable

  • • The circuit breaker sits at the tool-call boundary
  • • It trips on a threshold breach, an anomaly, or a manual pull
  • • Revocation stops one agent's scope while the fleet keeps running
  • • An untested kill switch is not a control

Detection wired to reporting

  • • Runtime detection connects to triage and severity classification
  • • A reportable event opens an incident and starts the Art. 73 timer
  • • The report is pre-filled from the trace and registry entry

Evidence on time

  • • The incident record is held as machine-readable evidence
  • • The reported obligation is met within the legal window
  • • Impact is contained to one agent and recovery is fast