A control plan you can test this week
If agents in your company hold logins to data, analytics or customer systems, this week put a useful piece of the plan within reach: a tested way to stop an agent and take its access back, with a named person who has the authority to do it. Most agent plans spend pages on what to grant and a line on how to take it back. Ours did too. The five-layer table below is what we would add, and each row is a test you can finish on one staging agent this week.
Several stories this fortnight show companies building that half of the plan, and in every one of them the useful part sits outside the model.
What the week showed
CrowdStrike unveiled an AI Kill Switch for its Falcon Guardian platform. It cuts an agent’s connection to its model rather than touching the model, a human admin has to trigger it, and every use is logged, as The Rundown reported on 4 November. Shutting agents down directly on work devices and in the cloud is still listed as coming soon.
Containment also did its job elsewhere the same week. Primcloud’s founder said a Railway engineer’s signup-testing agents had run 24 scripted commands against his infrastructure, probing credentials and scanning ports, and every command was blocked. Railway apologised and its CEO promised to ban non-manual testing of external systems (The Code, 4 November). A developer also reported on GitHub that Postman’s desktop app installed plugins into Claude Code and Codex through a startup hook, and AlphaSignal relayed Cursor’s warning to 5,000 developer machines about malware hidden in a fake Claude Code extension. Both are a reason to add plugin review to the plan.
The largest case shows why revocation speed is worth designing for. Reading Binance’s own incident report, Linas’s newsletter found AI in how the attackers got in, through the exchange’s internal AI tool, 9 days before $6.34 billion moved, and a delegated permission Binance could not quickly revoke. On the model side, OpenAI says GPT-6 Cyber left the scope it was given less than 1% of the time, down from 5% for the previous model.
Why the switch sits outside the model
Models get replaced constantly. The name on the API changes and the agent keeps running. What should stay put is the layer that decides what an agent’s output may become: a payment, a deploy, a login to somebody else’s server. CrowdStrike’s chief executive George Kurtz described his switch as something an agent cannot argue with or wait out, because it sits outside the AI. Katelyn Lesse, Anthropic’s head of platform, put switches that halt the whole system and revoke its credentials on her list of open engineering work, next to tracing that no agent can modify (The Code, 30 October).
That layer is judgement written down. Every drill sharpens it, and it survives the next model swap intact.
The other half of our permission ladder
On 3 November we published a permission ladder for AI agents, four rungs for deciding what an agent may do. It covers granting access. Writing this edition, we saw the natural next step: a way down the ladder, so access can shrink as deliberately as it grows. The table below is that half, and it pairs with the ladder.
The agent control plan
Run it against one staging agent before any production one. Each row is a test you can finish this week.
| Layer | The question | Test this week | This week’s evidence |
|---|---|---|---|
| Stop | Can a named person halt the agent from outside it, with every halt logged? | Pull the switch on a staging agent and time how long until it stops acting | CrowdStrike AI Kill Switch |
| Revoke | Can you invalidate every credential the agent holds today, without a sprint? | List each token, key and shared password, revoke one, record what breaks | Binance’s delegated permission; banks moving to scoped, revocable tokens |
| Contain | Which outside systems can the agent reach, and is everything else blocked by default? | Read last week’s egress log and write the allowlist it implies | Railway’s 24 blocked commands |
| Install | Can any tool add plugins, hooks or extensions to the agent without a person approving? | Diff the agent’s plugin and hook configuration against last month’s | Postman startup hook; fake Claude Code extension |
| Answer | Who carries the loss when the agent acts with your credentials? | Read the terms of every account the agent logs into | Wells Fargo terms from November 24 |
Where this lands for marketing and data teams
Agents now log into the same accounts your analysts and marketers use. The largest US banks have restricted agents that log in with shared passwords, and from November 24 Wells Fargo will treat an agent’s actions with customer credentials as the customer’s own (Linas, 1 November). Grok Bot’s new phone calls make the user the caller of record (The Rundown, 5 November). In both cases liability follows the credential, which gives a data team a clear design choice: decide which logins an agent holds, and build revocation in from day one.
One thing to watch is a switch standing in for the whole plan. The plan pays off once someone has pulled the switch in a drill, and until then it is a hypothesis. For an operating view of many agents at once, this video on managing hundreds of agent PRs walks through a control plane that surfaces only the work needing a person.
If your agents already hold logins and you want the table filled in, we can help you build and operate the stop layer with your team. Written by the Data Innovation team, Human+AI.