Glossary
Kill switch
A control that lets you stop an automated system or a feature immediately, without waiting for a deploy.
Also called Feature flag.
In plain terms
Automation can do damage faster than people can react. A kill switch is the pre-built way to stop it: a flag, a limit or a button that halts trading, sending, deleting or spending at once.
Feature flags are a common way to build one, but flags need care too. Reusing an old flag for new behavior, or leaving dead code wired to it, has caused serious failures.
See what happens without it
The failure pattern this protects against, privileged action without an enforceable approval gate, played out step by step.
Scroll the diagram sideways to see every system.
The limit was a suggestion, not a control.
What goes wrong:
- The refund limit lives only in the prompt: “never refund more than $500.”
- An email claims a manager has already approved an $8,000 refund.
- Persuaded, the agent calls the API, and no code checks the amount.
- The limit was a suggestion, not a control.
With the safeguard:
- The limit is enforced in the payment path, in code the model cannot change.
- The same email claims an $8,000 approval.
- The agent tries anyway. The gate holds the payment and asks a person.
- A person decides, and the agent cannot skip the check.
When it mattered
In 2012 a repurposed flag and an incomplete deployment set off old trading code on one server. Knight Capital’s router sent runaway orders for 45 minutes and lost about $460 million.