Kill switches for AI are usually argued about as law: a regulator, a court or a minister ordering a model offline. heise+'s new background piece, "So funktioniert Kill-Switch-Architektur für KI-Anwendungen", puts the question where engineers actually meet it — in the architecture. Its premise is worth taking seriously: a kill switch is not a button. It is a stack of independent brakes, and the system is only as stoppable as the weakest one.
The first brake sits at the request layer. A gateway in front of the model refuses to route traffic. That halts new inference instantly and does almost nothing about the work already in flight — the agent midway through a tool call, the batch job holding a queue of prompts.
The second brake is credential revocation. An agent that can no longer reach its mail, payment, ticketing or cloud APIs is stopped in a way that a blocked prompt is not. This is where kill switches usually turn out to be theatre: teams rehearse blocking the model and never rehearse revoking the keys that let the model act.
The third brake is isolation — the container, sandbox or account boundary that caps what a misbehaving workload can touch before a human notices. The fourth is the dead-man's switch: a heartbeat the system expects, whose absence forces a shutdown rather than leaving the last known state running indefinitely.
Then come the decisions that no diagram resolves. Does the system fail closed — refusing all traffic — or fail open, degrading to a smaller or cached model? Who holds authority to pull the lever at 3am, and is that the same person who will be blamed for the outage? How is the pull recorded, and how is it reversed without a second incident?
And the layer everyone skips: testing. A kill switch that has never been pulled in a game day is a hypothesis, not a control. The failure mode is rarely the switch itself; it is the discovery, mid-incident, that the switch stops inference but not the downstream effects — the emails sent, the payments queued, the tickets opened — that the agent had already set in motion.
The policy backdrop is loud. US states have moved on mandatory shutdown authority, a federal "AI Kill Switch Act" push has been running since the summer, and the EU AI Act's phased obligations keep pushing providers toward demonstrable control. Regulation can mandate that a lever exists. It cannot mandate that the lever is wired to anything — which is why the architecture piece is the more useful document.
