Ofer Klein is CEO and co-founder of Reco, a provider of enterprise ecosystem and AI agent security.gettyWhen I ask security leaders about how many AI agents are running in their environment, most can't answer. They know that they have AI agents, just not how many. ​This problem, which is part of the larger issue known as agentic sprawl, creates a foundational dilemma for what has become a key agentic governance strategy: the kill switch. The kill switch sounds decisive, and it paints a clean mental picture for containment, but there's no way to use it when you don't know that an agent exists in the first place. Similarly, emergency shutdown is only the last mile of agent governance. By the time an organization has to disable an agent, security should already know three things: where the agent is, what it can reach and what breaks if it goes dark. Most don't.​The kill switch also assumes a world that no longer exists. A year ago, humans were in the loop for every agent action. A prompt was generated, a human reviewed the output, the workflow moved forward. Shutting down that kind of agent was low-stakes because the queue was immediately paused and humans stayed in control.​However, agents run autonomously now, executing email, calendar, procurement and approval actions without waiting for a human to greenlight each step. That changes what a kill switch costs you, because you can't easily map what stops when the agent does.What The Kill Switch Looks Like In Practice​Consider a finance agent connected to an expense management application. It was created to reconcile invoices, summarize vendor contracts and flag unusual payment patterns. But let's also say the agent isn’t in an inventory, and that it was granted access to shared drives, procurement systems, approval workflows and payment-status data over time. The employee who configured it later changed roles. The agent remained active because its OAuth grant, API connection and workflow permissions were still valid.Now, the agent begins sending unusually broad summaries of vendor payment activity to a collaboration channel. Security wants to disable it immediately. Finance pushes back because the agent is tied to month-end close. Procurement says it may affect vendor approval workflows. IT is unsure which service account it uses. Legal asks whether contract data left the environment. The CEO wants to know whether money moved.​That is the real issue with a kill switch. Since agents are increasingly embedded inside applications and business processes, governance begins with three questions: Where are your agents? What can they connect to? What can they do?​Here are four steps for answering those questions: Start with operating context.​Every agent should have a named human owner who understands its purpose, access and expected behavior. That ownership has to remain current as projects end, employees change roles or agents are connected to new tools. During an incident, this accountability determines who can approve quarantine, access reduction or shutdown. This is where I see organizations struggling. AI agents are often introduced by business teams to solve immediate workflow problems. The agent may later be connected to additional tools, given broader permissions or used by a different team. After several months, no one has a complete view of why it exists or what would happen if it were disabled.Enable permission mapping to avoid business disruption.Before disabling an agent, security teams need to understand the authority it has accumulated and the blast radius it creates. Does it use a service account, a user-delegated OAuth grant, an API key or multiple credentials across connected systems? Can it read data, write records, modify permissions, trigger workflows or communicate externally?A customer service agent with read access to public knowledge base articles carries limited risk compared to one with access to support tickets, account records, refund workflows and customer data. Permission mapping gives security teams a way to intervene gradually. A high-risk agent may not require full shutdown. Reducing write access, revoking a stale token, disconnecting a sensitive application or requiring approval for certain actions may contain the risk with less business disruption.This is how governance supports business velocity. Controls become specific enough to reduce risk without disrupting every use case tied to the agent.Use behavior to establish a baseline.A kill switch also depends on knowing what normal looks like. This is harder than it sounds. When humans were on the loop for every agent action, unusual behavior was visible in the approval queue. Agents now run autonomously. You don't know the next action in advance. That means deviations surface after the fact, not before.For example, a finance agent that usually reviews invoices during business hours should draw attention if it begins accessing contract archives overnight or making unusually broad API calls. Deviations from expected behaviors help security teams distinguish routine automation from activities that require containment. They also help reduce the pressure to overreact. An alert with business context provides a stronger basis for deciding whether to monitor, restrict, quarantine or disable an agent.Build a staged response model.Agent governance should include a response ladder that can lead up to invoking the kill switch. The first level may be notification to the owner. The next may be permission reduction, token revocation, temporary quarantine or workflow pause. The final level is full shutdown.This staged model protects business processes. A blunt kill switch may be necessary when an agent is actively exposing data or triggering unauthorized actions, while many situations call for narrower intervention. Reducing scope can contain risk while preserving the business function.Rollback planning also belongs in the governance model. Security teams should know how to restore an agent safely after review, how to validate that risky access has been removed and how to document the decision. This evidence demonstrates to executives, auditors and regulators that agent control is more than a policy statement.​Governance is what happens before the incident: inventory, ownership, permission mapping, behavioral baselines, staged response. The kill switch is the last step in that sequence, not a substitute for the others.​Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?