Most enterprises can name their AI agent pilots. Few can name what would happen if one needed to be shut off tonight.
A CISO I know well ran a tabletop exercise a few months back. It wasn’t a phishing drill or a ransomware scenario. It was for an AI agent.
The scenario: one of the agents her team had deployed to handle vendor onboarding started approving requests outside its normal pattern. Nothing dramatic, just enough to be wrong and start causing issues downstream. The agent could be stopped. What nobody could answer was how long it would take anyone to notice, and who had the authority to pull the plug.
Her team walked out of that room with a two-week list of gaps to address. I’ve heard versions of this story from half a dozen other security leaders since then, and they all name the same three gaps (sometimes without even realizing they’re the same): nobody could say for certain who owned the agent, no one had tested revoking its access under pressure, and there was no agreement on who makes that call.That gap isn’t unique to her team. When McKinsey surveyed roughly 500 organizations this year, the ones that had named a clear owner and decision-maker for their AI initatives scored far higher on governance maturity than the ones that hadn’t.
Those three gaps are the kill-switch test, as I’ve taken to calling it. It’s a simple gate every agent should clear before it touches production: can you identify it, authenticate it, and shut it off? If you can’t answer yes to all three, the agent is not ready for production. You have an unmanaged identity running in your environment that happens to be useful. For now.
What is the kill-switch test?
Three questions, each one mapping to something identity teams already know how to do for human accounts.
Identify: Name the agent, what system it lives in, who takes accountability for it. “The automation team owns something in that workflow” doesn’t count. You need a name, a system of record, and an owner.
Authenticate: The agent has its own credential, scoped to what it actually needs to do, not a shared service account inherited from whatever got it running fastest during pilot. If two agents are using the same credentials, you’ve already failed this part.
Shut off: Someone can revoke the agent’s access right now, cleanly, without breaking the other processes that relied on it and without waiting for a change request to clear the approval queue. On demand, the same hour you decide to.
Most organizations can do this for a human employee’s account without hesitation. HR terminates someone, IT gets a ticket, access is pulled that day if the program is mature. Agents don’t have an HR system generating the triggering action. Nobody is watching for the moment an agent should be cut off, because nobody built that moment into the process.
You can’t govern what you can’t turn off
Governance is a word we use loosely in this industry. It usually means policies, approval workflows, and access reviews. All are useful, but none matter if you can’t act on what you find.
An access review that surfaces a problem agent is only as good as your ability to do something about it that afternoon. If pulling an agent’s credential means untangling which downstream processes will break, your review just documented a risk instead of closing a gap.
Legacy identity tooling wasn’t built for this. Governance platforms are strong on the request-and-approve side of the lifecycle: who asked for access, who signed off, and when it was granted. They’re weaker at the moment something needs to stop immediately, because human offboarding rarely happens under time pressure the way an active agent incident does.
Non-human identities (NHIs) outnumber human users by 45 to 1 in the modern enterprise, according to Rubrik Zero Labs, and that was before agentic AI adoption accelerated the way it has over the last 12 months. Every one of those NHIs is a credential someone eventually needs to be able to turn off on short notice. Most identity programs were designed and scoped around human behavioral rhythms: login, work a session, log off. That assumption no longer holds.
This is where identity threat detection and response (ITDR) comes in. ITDR watches behavior continuously and flags when an identity, human or not, does something outside its established pattern. For an agent running around the clock with standing access, that continuous behavioral view is what makes “shut it off” a decision you can make in minutes instead of a forensic exercise you run after the fact.
Testing your agents
Run the kill-switch test against whatever agents you already have in production.
Start with identity. Pull a list of every agent with system access right now and see how far you get before someone in the room says “I think that one’s running but I’m not sure who owns it.” That uncertainty is your detection gap.
Move on to authenticate. Check whether each agent has a distinct, scoped credential, or whether several agents share one set because it was faster to set up back before the pilot. A shared credential is the single most common failure point I see when I walk through this exercise with clients.
Finish with shut off. Pick one agent, ideally a lower-stakes one, and actually test revoking its access. Time it. Note what broke. This step tells you more about your real readiness for agents than any policy document I’ve ever seen.
If an agent fails any of these three steps, don’t panic. You just found the specific, fixable gap you need to close before the next agent goes live.
Boards are asking sharper questions about AI risk than they were just a year ago. More than 60% of directors now set aside full-board time for AI, according to the National Association of Corporate Directors, up sharply from prior years. Most of those questions eventually land on identity, whether the board realizes it or not. “Can we see what our agents are doing” and “can we stop one if it goes wrong” are identity questions wearing an AI disguise.
I’d rather a security leader tell their board “we test this quarterly and here’s what we found” than “we haven’t had an incident yet.” The second one means the clock just hasn’t run out yet.
The agents already running in your environment aren’t going anywhere, and more are coming. The question worth answering this quarter is: can you turn one of your agents off tonight if you had to?
Key Takeaways
- The kill-switch test is a three-part test: can you identify an agent and its owner, does it authenticate with its own scoped credential, and can you revoke its access immediately without breaking dependent processes.
- A shared credential across multiple agents is one of the most common failure points security leaders find when they run the kill-switch test on their AI agents.
- Governance without the ability to act on findings just documents risk. Identity threat detection and response (ITDR) closes the gap by watching behavior continuously.
- Non-human identities already outnumber human users by 45:1 in the modern enterprise. Agentic AI is only accelerating the growth of that ratio.
- Testing agent revocation before an incident is the single fastest way to find out whether your organization is truly ready for agentic AI.