Contain AI agents manually using kill switch protocol

Deactivate or reinstate AI agents using kill switch protocol to eliminate malicious activity and improve your security posture.

Before you begin

Role required: AI steward [sn_ai_governance.ai_steward]

Make sure that you have configured connectors and optional identity providers for AI agent containment. For more information, see Configure AI agent containment using kill switch protocol manually.

About this task

You can manually deactivate an AI agent two ways. If a security event is detected for the agent, a banner appears indicating that malicious activity was detected for the AI asset, offering deactivation, as described in the following steps.

You can also manually deactivate any managed AI agent directly, whether or not it has an associated security event, by opening the AI asset record and, from the Actions menu, selecting Deactivate Agent. This option is available only for managed AI agents. For details, see Deactivate a managed AI agent.

Note: To contain AI agents automatically through policy enforcement, see Controlling AI asset usage in AI Control Tower.

Procedure

1. In AI Control Tower, navigate to one of the following:

   • Govern > Security > Overview > Your top recommendations

   • Activity Center > Recommendations

   • The AI asset record's Overview tab or Security tab, for AI agents in the Agentic AI category.

2. Open an AI asset event of any severity (Critical, High, Medium, or Low).

3. Select and view the AI asset associated with the critical event.

   A banner appears informing you that there is malicious activity detected for this AI asset.

4. On the banner, select View containment options.

   [Omitted image "gov-sec-malicious-activity-banner.png"] Alt text: Banner indicating that malicious activity was detected for the AI agent.

   A pane appears with information about the activity detected for this AI asset, and the next best action to take.

5. Select Deactivate.

   [Omitted image "gov-sec-malicious-activity.png"] Alt text: Malicious activity evidence shown for an agent.

6. Provide the reason for the deactivation and select Deactivate.

   [Omitted image "gov-sec-deactivate-agent-confirmation.png"] Alt text: Deactivation confirmation with a prompt to enter the reason for deactivating the AI agent.

   The banner on the AI asset changes to reflect the progress of deactivation.

7. If the deactivation status shows as Failed or Partial, select Retry on the banner.

8. Select View agent containment list to track the progress of the deactivation.

   [Omitted image "gov-sec-view-kill-switch-protocol-log-banner.png"] Alt text: In progress banner message with a View agent containment list button.

   For more information, see Review the agent containment list.

9. After deactivation is complete, you can reinstate the AI agent by resolving the critical security task for the AI agent first.

10. Navigate to Security > Overview > Contained AI Agents.

11. In the AI agent row, under Actions, select Reinstate.

12. Enter a reason for reinstating the AI agent and select Reinstate.

13. Review the agent containment list
    The agent containment list shows agents that were deactivated and reinstated for the instance manually with kill switch protocol or automatically by policy enforcement. You can view audit log information for each AI agent which can help you stay compliant with regulatory guidance and your business rules.

Parent Topic:Managing AI asset security with AI Control Tower