We ship a big red button whose only job is to stop our own product. It's on by default, it belongs to the operator, and we ask teams to test it monthly. People sometimes read that as a lack of confidence. It's the opposite — the kill switch is what makes confidence rational.
Why default-on matters
A safety control you have to opt into is a safety control most people never find. Default-on means the very first thing true about a new Magistry workspace is that the operator can stop it instantly. Autonomy is granted from a position of control, not recovered after losing it.
When the switch trips, executors stop writing mid-cycle. In-flight actions that already landed keep their reverse ops, so you can roll back cleanly. Nothing is left half-applied. Stopping is a clean state, not a crash.
When to press it
- A metric moves in a way you don't understand yet — stop first, diagnose second.
- An upstream platform (Shopify, an ad API) is behaving abnormally and you don't want the agent reacting to bad data.
- A launch or sale where you want a human hand on everything for a day.
- A drill — press it on purpose, on a normal day, so it's muscle memory before you need it.
The teams that trust autonomy the most are the ones that have pressed the kill switch on purpose and watched everything stop cleanly. Trust is earned in the drill, not the demo.
— Talia Reyes
Why we drill it
A switch you've never tested is a hope, not a control. We encourage a monthly drill because the worst time to discover your stop button is theoretical is the moment you actually need it. Press it, confirm writes stop, confirm rollback works, turn it back on. Five minutes. It changes how a team feels about handing over the store — and that feeling is the product.
We'd rather you stop us too often than too late. A kill switch pressed by mistake costs you a cycle. A kill switch you didn't have costs you the thing you can't get back: trust in the system.