Emergency Controls
Emergency controls let admins and authorized SOAR integrations stop agent activity when something goes wrong. Dashboard/JWT-triggered high-impact actions require a verified SignedApproval approval before execution; SOAR API keys with the required permission execute directly and are audited.
Available controls
| Control | Scope | Effect |
|---|---|---|
| Pause Agent | Single agent | Trips the circuit breaker. The agent's session is suspended and no further tool calls are processed until an admin resumes it. |
| Pause All Agents | Organization-wide | Suspends all active agent sessions across the organization. Use during a security incident affecting multiple agents. |
| Revoke Keys | Single agent or org-wide | Immediately invalidates the agent's scoped tokens and API keys. The agent cannot make any further requests until new keys are provisioned. |
Emergency approval
Emergency controls are high-impact actions. Dashboard/JWT callers request a SignedApproval approval that is bound to the requester, action, and target; it must be approved with a verified receipt within 5 minutes. Authorized SOAR keys can execute the actions covered by their permissions directly, with the key prefix and action written to audit.
Identify the threat
From the SOC Console, review the security event feed and live sessions table to identify the agent or agents that need to be stopped. Note the agent name and session ID.
Initiate the emergency control
Click the agent's session row to open the detail drawer. Click Pause Agent, Revoke Keys, or navigate to the emergency controls panel for org-wide actions like Pause All Agents.
Provide a reason
Enter a brief description of why you are taking this action. This is logged in the audit trail and included in the approval request sent to the second admin.
Complete approval
SignedApproval sends a notification with the action details and your reason. The approval has 5 minutes to complete. If approved with a verified receipt, the action can execute. If rejected or expired, the action is cancelled.
Verify and follow up
After the action executes, verify in the SOC Console that the agent session is paused or keys are revoked. Review the audit trail for the emergency control entry. Investigate the root cause before resuming agent operations.