Beyond the kill switch.

An emergency stop is essential for consequential systems because it must remain independent of the model being stopped. It should not ask an LLM whether stopping is appropriate, and a physical system’s local emergency control must remain authoritative. Yet a binary switch alone is too coarse for daily enterprise work. If every uncertainty shuts down a workflow, people route around the control. If intervention begins only after catastrophic evidence, the boundary has waited too long. Accountable action needs a response vocabulary between silent permission and total shutdown.

A proportionate ladder—allow, hold, limit, quarantine, revoke—matches intervention to evidence and impact. An unknown recipient can trigger a hold while an owner verifies identity. A request for raw records can be limited to an approved aggregate. Revoked consent should deny execution. Repeated attempts to perform the same prohibited action through another covered tool can quarantine the session. The operator stop overrides every rung, blocks new execution and persists when the user changes tasks or scenarios.

Imagine an agent asked to update a supplier’s payment destination. The first request includes a known supplier, an approved change ticket and the usual approver. Minutes later, the destination changes again, an urgency message appears and the agent tries a second payment tool after the first route holds. No single event necessarily proves fraud. The sequence, however, changes what a prudent system should do. A per-call authorization check may miss that accumulation; sequence-aware control can hold the first anomaly and quarantine the covered session after the workaround attempt.

Studying sequence does not require invisible chain-of-thought inspection. The relevant evidence is observable: declared purpose, principal, recipient, action parameters, tools, approvals and time. That evidence also defines the limits of coverage. If a user exports the same data through an unconnected tool, the control cannot see or stop it. A credible interface names controlled paths, logs bypass tests and never turns absence of evidence into a claim of universal monitoring.

Recovery is part of the safety design. Resume should require explicit review, explain what changed and return queued work to a non-executing state. It must never replay an action merely because the stop was lifted. The testable hypothesis is that a staged response reduces prohibited execution and operator work compared with binary allow/deny, without increasing severe misses. A held-out evaluation would vary action impact, evidence quality, sequence length, alternative-tool attempts and stop timing, then compare a static rule baseline with sequence-aware intervention.

Measurements should include prohibited-action prevention, unnecessary holds, escalation accuracy, time to human resolution, revocation latency, p95 execution overhead and review effort. Recovery tests should confirm that stop state survives task changes, no action autoexecutes after resume and local hardware stops retain priority. Brad Smith’s call for safety brakes in critical-infrastructure AI establishes the policy rationale; the engineering question is how to make braking proportionate, independently enforceable and operationally recoverable.