Anatomy of a wallet kill switch
Two layers, one rule: when there's an incident, halting spend is faster than rolling back a deployment. Here's how Mission Control's kill switch works.
Paste a manifest into the public demo or bring a scoped workflow to the private beta.
Two layers, on purpose
MC_KILL_SWITCH=1 in env: tripped at boot, can't be cleared via API. For pre-deploy gating and CI runbooks. The operator who needs to clear it has to redeploy.
POST /v1/admin/kill-switch (runtime): tripped without a redeploy. For incident response: a vendor degrades, a prompt goes haywire, a compliance investigation pauses spending. An admin trips it; spend halts; the audit ledger records who did it and why.
Why the kill switch bypasses the idempotency cache
Even cached idempotent replays go through the kill-switch fence. That's intentional: a replay still consumes vendor capacity, still touches the vendor's logs, still produces a delivery in webhook subscribers. During an incident, halting all of that — not just the new spend — is the point.