Use the Kill Switch

The Kill Switch is an emergency control that immediately blocks traffic beneath the level it’s activated on. Use it when you need to stop AI usage right now — for example a suspected data leak. It exists at three levels — Organization, Project, and module instance (Project Guardian · Project Stratum) — each an independent on/off toggle (the company itself has none). If any level is on, all traffic beneath it is blocked. v1.4 generalizes the former Project Guardian level to the module instance level: you can now emergency-stop one module — say, just the Stratum instance — without stopping the whole project. The Kill Switch is strictly for emergencies; module instances have no everyday enable/disable toggle. A planned stop is expressed by removing the instance, and running without classification by leaving no policy pinned.

​

Activate

Open the project’s Settings → General → Danger Zone and choose Activate Kill Switch. While active:

• All traffic beneath it is blocked at the gateway — even for Active API keys. Key states are left untouched and resume the moment you clear the switch (the two are independent, checked separately on every request).
• New API-key creation is blocked anywhere beneath an active switch.
• Desktop Agents under the level receive the blocked response and stop the outbound request to the AI service.

Callers receive a single blocked response (see Errors & states) that deliberately doesn’t reveal which level or resource fired — that detail goes only to the Audit Log and Opticon. Activation and deactivation are recorded in the Audit Log; blocked attempts while it’s on are not logged there (only real changes are).

​

How it plays out on the batch paths

On the real-time path, request, inspection, and outbound delivery are fused into one call, so activation blocks requests inline and immediately. On the batch paths, intake and completion are separated in time — so the same goal (immediate containment) is enforced differently per path. An activation at any tier propagates to the batch paths beneath it. Stratum grading batch — external-transfer freeze. Classification is internal analysis and creates no external exposure by itself, so instead of halting the classification work, Starfort freezes the outbound gate: S3 de-identification batch — immediate stop, no output. This batch’s output is the write to customer storage (tgt), so continuing to process means continuing to export. It stops rather than freezes: Reprocessing after deactivation is a re-submission of the same src — de-identification reproduces identically on re-run, so there is no notion of resuming a stopped job.

​

Recover

Deactivate the Kill Switch from the same Danger Zone. Traffic resumes normally — the switch doesn’t change your policies or keys, it only gates traffic while active.