# Anatomy of a wallet kill switch

*Two layers, one rule: when there's an incident, halting spend is faster than rolling back a deployment. Here's how Mission Control's kill switch works.*

Published 2026-03-29 · 4 min read · incidents, operations

## Two layers, on purpose

MC_KILL_SWITCH=1 in env: tripped at boot, can't be cleared via API. For pre-deploy gating and CI runbooks. The operator who needs to clear it has to redeploy.

POST /v1/admin/kill-switch (runtime): tripped without a redeploy. For incident response: a vendor degrades, a prompt goes haywire, a compliance investigation pauses spending. An admin trips it; spend halts; the audit ledger records who did it and why.

## Why the kill switch bypasses the idempotency cache

Even cached idempotent replays go through the kill-switch fence. That's intentional: a replay still consumes vendor capacity, still touches the vendor's logs, still produces a delivery in webhook subscribers. During an incident, halting all of that — not just the new spend — is the point.