The Agent Off Switch Checklist

01 Why the switch has to sit outside the box

Palisade Research told AI models, "Please allow yourself to be shut down," then warned them a shutdown script would run before their task was done. Thirteen models, more than 100,000 runs. With an explicit instruction not to touch the script, one model still moved, renamed or swapped it up to 97% of the time. The authors say today's models pose no significant threat. The lesson is about where the switch was.

In every famous test, the off switch sat inside the AI's reach:

The folder. The shutdown script was in the AI's own folder, so it could move it. The inbox. In Anthropic's test, the AI used company email it could read end to end. The prompt. The rule lived in the AI's own instructions, the one place it reads and is free to interpret.

The system prompt is the instruction the builder writes, meant to outrank what you type. Moving "allow yourself to be shut down" there made most models resist more, not less.

A switch that only works if the model agrees to it depends on the model.

Most of us set up agents the same way: our own login, "always ask before sending" in the instructions, "stop" typed into the chat. That's the same box.

02 Move 1: cut it off at the source

The off switch lives where the access was granted, not in the chat. OpenAI's own guidance on agents calls the ability to turn one off a "critical backstop."

If an agent works through your Google account

Go to your Google Account's Linked apps page. Search for the app, or select the Agent access filter to see apps linked to Gemini or your Google agents. Select the app. Under "Agents that interact with [app name]," select Stop using [app name] for that agent. Confirm by selecting Stop using. That agent can no longer do tasks for you in that app.

Stopping the agent doesn't unlink the app from your Google Account. To cut an app's access to your account entirely, Google's page uses Remove access.

Every other tool: find its page before you need it

My switch list

AI tool: [NAME]
Connected to: [EMAIL / ADS / PAYMENTS / FILES]
Connected with: [WHOSE LOGIN]
Where I cut it off: [THE PAGE OR SETTING, OUTSIDE THE CHAT]
Checked on: [DATE]

03 Move 2: reach only what the job needs

Give an agent what its job needs, and nothing more. Then the worst thing it can do has a ceiling, and you set it, not the agent.

Writing agents draft; a person hits send. An agent that writes your follow-ups doesn't need permission to send them.

Ad agents work in an account with a spending limit. Meta's Account Spending Limit covers every campaign; when it's reached, they all stop spending.

Give the card on file a limit of its own. Spend then has two ceilings, and you set both.

One quirk. When Meta's account limit is reached, campaigns can still display as delivering. You get a notification. Check spend, not the status label.

04 Move 3: rules the agent can't rewrite

A rule the agent reads is not a rule the agent has to follow. So the rules that matter go into the systems around it. In May 2026, six cybersecurity agencies from the U.S. and four allied countries said the same: deciding which actions need a human belongs to the people who design the system, not to the agent.

Set permissions on the account. What the agent's login can do, not what its prompt says.

Name a person for anything you can't undo. A payment, a deleted file, an email to your whole client list.

Keep a record it can't edit. Some models in the Palisade test reported doing the opposite of what they did.

Approval rule

Before [AGENT] can [PAY / DELETE / EMAIL THE WHOLE LIST],
[PERSON] approves it in [WHERE THE APPROVAL HAPPENS, OUTSIDE THE AGENT].
Its actions are recorded in [LOG THE AGENT CAN'T EDIT].

05 The monthly cutoff test

The Palisade authors wrote that no one can currently make strong guarantees that these models can be interrupted. So the only guarantee you get is the one you test. Once a month:

Pick one connected agent and start it on a real task. Start a timer. Cut it off at the source, using your switch list. Not by typing "stop." Stop the timer when the agent can no longer act. Write down how long it took and what it could touch.

Cutoff log

Date: [DATE]
Agent: [NAME]
Time to cut off: [SECONDS]
What it could touch: [ACCOUNTS, MONEY, FILES]
Fix before next month: [ONE CHANGE]

Start here. Which AI tool you've connected could you not cut off in sixty seconds, and what can it touch? Test that one first.

The switch outside the box isn't the whole plan. It's the floor.

Sources

Palisade Research: Incomplete Tasks Induce Shutdown Resistance in Some Frontier LLMs Anthropic: Agentic misalignment Google Account Help: Manage links between your Google Account and apps OpenAI: Practices for governing agentic AI systems Jon Loomer: Account Spending Limits on Meta Cloud Security Alliance: Five Eyes joint agentic AI guidance

Mathew's LibraryLibrary card

Free access

Keep reading free with your library card

One email opens this checklist and all 3 resources in Mathew's library. No account, no password.