The kill switch: revocation as the principal's basic right
Last updated: · Leutrim Miftaraj
The kill switch is the non-negotiable element of every agent mandate: the person granting the mandate can end any authority at any time, without giving reasons. Revocation is atomic — status change, evidence entry and webhook commit together — and takes effect from the next verification, without a cache.
Why immediate matters
An agent acts at machine speed; a revocation with hours of latency is a revocation in law but not in practice. Hence the online duty: verifiers must check the status live (Cache-Control: no-store) — a status older than five seconds loses the protection of the receipt.
Architectural consequence
Revocation runs through a separate minimal endpoint with its own infrastructure and keeps working even when the rest is degraded. After revocation every verification returns MD-201 — deterministic, machine-readable, provable.
Legal effect
Revoking the mandate also operationalises the withdrawal of data-protection consent (Art. 7 GDPR) — in seconds instead of support tickets.
Key takeaway
A mandate without instant revocation is a risk with a signature. The kill switch makes delegation reversible — and therefore acceptable.
Try it yourself
Issue your first agent mandate and check your first decision with its receipt — free, in a few minutes.