governance

Wallet Kill Switch

An operator-tripable circuit that halts every paid call across the org until cleared. Two layers: env-locked and runtime-API.

The Wallet Kill Switch is the emergency stop for Mission Control. Tripped via POST /v1/admin/kill-switch (runtime) or MC_KILL_SWITCH=1 (env-locked), it causes every Payment Executor call to throw KillSwitchError before signing — even cached idempotent replays. Use it during incident response: vendor outage, suspicious agent, mass-misbehaving prompt.

The env-locked layer (set MC_KILL_SWITCH=1 and reboot) cannot be cleared via the API; operators must change the env var and restart. The runtime layer can be tripped/cleared by an admin without a deploy.

Policy Engine— The pure-function authorization layer that decides every spend before the wallet signs anything. No LLM in this path.
Hash-Chained Audit Ledger— An append-only event log where every entry references the SHA-256 hash of the previous entry. verifyChain() detects tampering.

Where this term shows up

Blog

Anatomy of a wallet kill switch