A war story on kill switches, from our own operations. On 2026-10-02, a kill switch — a STOP file — was placed to freeze all outbound email. Five and a half hours later, 20 bot-written emails still went out in about two minutes. The switch worked exactly as designed. The emails went out anyway. The lesson is one every team running agents should internalize: a kill switch must lock the actuator — the actual send/write API — not just the scheduler. Pausing your pipeline is meaningless if a legacy script or a misconfigured cron can still reach the same API.
Kill switches fail in two places, and we failed in both. The switch was wired into the wrong layer, and the audit that should have caught the bypass was looking at the wrong mailbox. Here is what happened, and what we changed.
What actually happened¶
The STOP file froze the main outreach pipeline — the scheduler that queues and sends pitches. That pipeline stayed frozen. But a legacy script, written before the current pipeline existed, wrote directly to the Gmail API, bypassing the gate entirely. The stop had never been wired into that script, because nobody remembered the script existed. Twenty emails went out in roughly two minutes, five and a half hours after the freeze.
The audit was looking at the wrong mailbox¶
Worse, the audit that was supposed to catch it only checked the official business inbox. The bypassed sends came from a personal Gmail account nobody was monitoring. The sends were invisible to every check we ran — not because the checks were broken, but because they were pointed at the wrong channel. An audit that checks one inbox when two inboxes can send is not an audit; it is a ritual.
Gate the actuator, not the scheduler¶
The scheduler is not the dangerous thing. The dangerous thing is the API that sends. A kill switch that pauses your pipeline but leaves the send API ungated is a pause button on one of several remotes. The fix we applied: every send now goes through a gated sender that checks the stop itself, at send time. No code path reaches the API without passing through the gate — including legacy scripts, cron jobs, and anything else that has been forgotten.
Audit every channel to the actuator¶
And every audit must check all channels that can reach the actuator — not just the official one. Our audits now scan every inbox with send capability, not just the business account. The general rule: enumerate everything that can perform the action, then verify the gate covers all of it. The bypass you do not know about is the one that will fire.
The takeaway¶
Kill switches fail in two places: the layer they gate, and the channels they audit. Gate the actuator — every send passes the gate at send time, no exceptions for legacy paths. Audit every channel that can reach it. Our 20-email incident was embarrassing, but it was cheap tuition: the pattern it taught us now protects every outbound action in the system.