Stopping an AI Agent Should Take One Click, Not a Password Rotation

Picture the moment. An agent with read access to production is doing something odd — asking for tables it has never touched, at three in the morning. You want it stopped now, and you want everything else to keep running.

If the agent connects with database credentials, every option is bad. Rotate the password and you take down every service that shares it. Drop the user and you lose the grants you will need to put back. Kill the process and hope it does not restart. None of them means “stop this one agent until I have looked”.

Revoke is the wrong button too

A scoped token per agent fixes the shared-credential problem: revoking one agent’s token leaves the others alone. But revoke is permanent. The token is gone, with its scope and budgets, and getting the agent back means issuing a new token and redeploying its configuration.

When you do not yet know whether an agent is compromised or merely confused, permanent is too strong. People hesitate, and the hesitation is the expensive part.

Pause: one agent, next request, reversible

So there is a third state. Pausing a token — from the token list, or straight from the Live view where you spotted the problem — does three things:

• The very next request is refused. The token is read from the database on every request, with no cache in between, so there is no propagation delay to wait out.
• Every token it delegated stops with it. An application that exchanges per-user tokens has one parent; pausing the parent stops all of them without hunting them down one by one.
• Nothing is lost. The token keeps its scope, budgets and history, and resuming is one click.

The agent gets a plain refusal, and every refused request is written to the audit log with the reason — so afterwards you can see what it kept trying while it was stopped.

POST /api/v1/agent-gateways/agent/query
403  This agent token is paused by the gateway owner.

Letting the gateway pull the switch

A person noticing is the slow path. Two signals are strong enough for the gateway to act on by itself, if you opt in:

• A canary read. A canary is a row nobody has a legitimate reason to read — a customer who does not exist, an order that was never placed. Returning it means a broad scrape or a targeted read of something fictional. Either way you want to know now.
• A burst of policy denials — say, three within five minutes. An agent that keeps asking for tables and columns it was never given is the usual visible sign of a hijacked prompt.

Only policy denials count toward the burst. Hitting a rate limit or a budget means the agent is busy. Probing for data outside its policy means it is being steered. Counting both would quarantine your busiest honest agent first.

Auto-quarantine is off until you turn it on, because a pause stops a working agent and that should be the owner’s decision. When it fires it is a pause, not a revoke, with the same one-click resume, and an anomaly webhook goes out so the alert reaches whoever is on call. Two requests tripping the rule at the same instant produce one quarantine and one audit row, because the pause is a single conditional update.

The bug we found in our own first version

An owner resumes a quarantined token after checking it. The agent’s next request is denied once more, for an ordinary reason — and the token is quarantined again on the spot, because the denials that caused the first quarantine are still inside the five-minute window.

The fix is to start counting again from the resume. Denials the owner has already looked at no longer count against the token. It is a small change, but without it “resume” did not mean resume.

What to set up today

• Give every agent its own token, so stopping one never touches another.
• Plant a canary row in each table an agent can read, and turn on quarantine-on-canary.
• Set the denial threshold well above anything a correct agent produces. A week of traffic on the Live view tells you what normal looks like.

Pause, resume and auto-quarantine ship in the DBShifts AI Agent Gateway. The denial burst is often the first sign of the attack described in Your Database Rows Can Prompt-Inject Your AI Agent.