Stop a single agent immediately

The fastest safe action

Pause the agent. It refuses every request immediately, keeps the identity and credential, and is reversible in one click.

Do this before investigating. Reading the activity timeline while the agent is still acting means the thing you are reading about is still happening.

Then, in this order

1. Pause — stops further requests.
2. Read the record — what did it do, and which gate allowed it?
3. Terminate sessions if you suspect the credential rather than the policy. This invalidates credentials connection-wide.
4. Narrow the permission that allowed the action.
5. Unpause only after step four.

If you are not sure which agent

Use site read-only. It stops every write while leaving reads working, so you can still use the timeline to identify the source. Then pause the specific agent and return the site to normal.

Related guides

• RecoveryUse read-only and paused

  Three site modes that take effect immediately across every agent. Which to reach for, what each still permits, and why stopping is never gated by plan.

• RecoveryTerminate sessions and credentials

  Sessions are ended connection-wide and credentials invalidated before the connection state changes, so nothing in flight outlives the decision.

• RecoveryReturn to normal after an incident

  A checklist for coming out of an emergency mode: change the cause first, verify the controls, then restore service — and write down what you changed.