Anatomy of a kill-switch\n\nA proper kill-switch has four components:\n\n1. **Trigger** — who can pull it, and how fast?\n2. **Scope** — does it stop one action, one agent, or the whole fleet?\n3. **State** — what happens to in-flight work?\n4. **Resume** — how does work restart afterwards?\n\nSkip any one and you have a panic button, not a kill-switch.