The kill switch is a per-store flag you own — off in normal operation, and when you flip it on, every worker job that writes or spends refuses to start. This playbook is about making it a control you trust rather than a button you've never pressed.
Decide who holds it
One named owner, plus one backup. In practice the best owner is whoever feels the consequences most — Head of Paid Media, Head of Retention, the founder. Ownership should sit with accountability, not with engineering.
Agree the triggers in advance
- A metric moves in a way no one can explain yet — stop first, diagnose second.
- An upstream platform is behaving abnormally and you don't want the agent reacting to bad data.
- A high-stakes launch or sale where you want a human hand on everything for a day.
Run the monthly drill
- 1On a normal day, press the kill switch on purpose.
- 2Confirm new write jobs refuse to start — they show up as skipped runs in the job log.
- 3Verify in-flight actions were stamped in the decision_log and are reversible.
- 4Flip it back on. Total time: about five minutes.
A switch you've never tested is a hope, not a control. Drill it before you need it.