AI Agent Circuit Breakers: The Production Reliability Pattern Every PM Needs to Understand
TL;DR
A circuit breaker is an automated control that trips when a threshold is exceeded, stopping an agent before damage accumulates. A kill switch is a human-operated control triggered after something has gone wrong. These are two different tools with different placement, different triggers, and different fallback behaviors. CrowdStrike shipped an enterprise-grade kill switch for autonomous agents in November 2026. This guide explains both patterns, what they protect against in AI agent architectures, the thresholds a PM is responsible for setting, and the launch checklist items that ensure neither is skipped.
The AI PM Minute
One tactic to make you a sharper AI PM, twice a week. 60 seconds to read. Free.
No fluff. Unsubscribe anytime.
Why AI Agents Break Differently Than APIs
A traditional API failure is local and fast. One request fails, the caller retries or surfaces an error, and the problem is bounded. An AI agent failure is iterative and expensive. The agent calls a tool, the tool returns an ambiguous result, the agent tries a different approach, calls more tools, generates more tokens, accumulates more cost, and may take irreversible actions along the way before anyone notices the original call was bad.
The distributed systems concept of the circuit breaker was designed for exactly this kind of cascading failure. It was introduced to handle the problem of a downstream service that is slow or unavailable: instead of queuing indefinitely and exhausting resources, you open the circuit, fail fast, and check periodically whether the service has recovered. Applied to AI agents, the same logic holds: instead of letting a misbehaving agent run indefinitely, you trip a threshold and stop it.
What agents can do that APIs cannot
- •Take irreversible real-world actions (send emails, create tickets, execute trades)
- •Accumulate cost across dozens of tool calls before returning
- •Loop indefinitely on ambiguous tasks without a natural termination condition
- •Hallucinate their way through multi-step workflows with plausible-looking outputs
What circuit breakers protect against
- •Runaway cost: an agent that keeps calling the LLM API past your spend ceiling
- •Loop explosions: an agent that hits its iteration limit without completing
- •Scope violations: an agent that requests permissions or accesses data outside its defined boundary
- •Latency spikes: tool calls that have hung past their timeout, blocking the whole workflow
Circuit Breakers vs Kill Switches: Two Different Controls
Practitioners confuse these constantly. The confusion causes production incidents because teams build one thinking they have both.
Circuit Breaker
Trigger: Automated. Trips on a threshold: cost per session exceeded, iteration count exceeded, error rate above baseline, latency beyond timeout.
Operator: No human in the loop. The control fires before anyone has noticed the problem.
Behavior: Stops the agent run, returns a defined error state to the caller, and optionally queues for retry after a cooldown period. Does not necessarily terminate the agent process.
Analogy: The fuse in an electrical panel. Trips automatically when load exceeds safe capacity.
Kill Switch
Trigger: Human-operated. Someone on call decides to stop an agent that is behaving badly, consuming too many resources, or causing visible harm in production.
Operator: Requires a human decision, but the execution must be instant: the switch must be operable without a code deploy.
Behavior: Should stop in-flight tasks if possible. A kill switch that only prevents new tasks from starting but cannot interrupt currently executing tasks is incomplete. State must be stored externally, not in process memory, so the switch survives a restart.
Analogy: The emergency shutoff on industrial equipment. A human pulls it, but it must work immediately and completely.
November 2026 industry signal
CrowdStrike added an AI Kill Switch to Falcon Guardian in November 2026. When triggered, it terminates the misbehaving agent where it runs, blocks it from relaunching, and cuts its network access. The fact that an enterprise security vendor shipped this as a named feature confirms that the absence of an operational kill switch has become a recognized production risk, not just an edge case.
Placement: Where These Controls Live in the Architecture
The right answer, repeated consistently across practitioner writing, is a single enforcement point outside the agent code itself. The rationale is consistent identity, telemetry, and policy context: the enforcement layer sees all traffic, not just what one agent reports about itself.
LLM Gateway / Proxy
Sits between your application and the model provider API. Can enforce token budgets per session, per user, and per time window. Can interrupt a request that would exceed a cost ceiling before it reaches the model. Some providers offer this natively; others require a self-hosted proxy.
Owns: Cost-based circuit breakers, model routing fallbacks, rate limiting.
Agent Supervisor / Orchestrator
A separate process that monitors agent runs. Checks step count, wall-clock time, and tool call patterns against predefined limits. Can inject a stop signal into the agent loop. This is distinct from the agent's own self-reporting, which cannot be trusted for safety-critical limits.
Owns: Iteration-based circuit breakers, timeout-based circuit breakers, scope violation detection.
Feature Flag System
Every AI agent capability should be wrapped in a feature flag that can be disabled without a code deploy. The flag is the kill switch substrate: when you need to stop an agent in production, you flip the flag. The flag must be evaluated at request time, not at startup, so it takes effect immediately.
Owns: Human-operated kill switches, geographic or segment-level rollback, emergency shutoffs.
Build Production-Ready AI Products
The AI PM Masterclass covers agentic system design, reliability patterns, and the launch checklists that keep AI products stable. Taught live by a Salesforce Sr. Director PM.
What the PM Owns: Defining Thresholds, Not Writing Code
Engineering implements circuit breakers. The PM is responsible for the business logic that drives the thresholds: what counts as "too much," what the fallback experience should be, and what the tradeoff is between agent autonomy and control.
Cost ceiling per session
Question to answer before launch: What is the maximum you will spend in model and tool costs for a single agent run?
This is a business decision, not a technical one. It depends on what the user paid, what the LTV of that user is, and how much failure tolerance exists. A $0.50 ceiling on a $20/month SaaS user might be right; a $5.00 ceiling on a $500/month enterprise user might be right too. Neither is a default.
Maximum iteration count
Question to answer before launch: How many LLM calls or tool calls are acceptable in a single agent run before you give up?
This prevents infinite loops. The right number depends on task complexity. A research agent might legitimately need 50 steps; a form-filling agent should never need more than 10. Set per task type, not globally.
Fallback behavior
Question to answer before launch: When the circuit trips, what does the user experience?
This is a product design decision. Options: a graceful error message with a retry button, a partial result with a disclaimer, escalation to a human, or silent failure with logging. Each has different user experience and cost implications. It must be designed before launch, not decided by the engineer on call.
Kill switch scope
Question to answer before launch: When you flip the kill switch, does it stop all users or just the affected segment?
A global kill switch stops all damage but also all value delivery. A segment-scoped kill switch (by user tier, by geography, by feature flag cohort) is slower to deploy but less costly to users. The PM should define the kill switch scope before launch, not at 2am during an incident.
Soft Stop vs Hard Stop: The Kill Switch Has Two Modes
The most cited problem with naive kill switch implementations is that stopping mid-task is expensive. If an agent has completed 40 of 50 steps in a workflow and you trigger a hard stop, you lose 40 steps of work and potentially leave external systems in an inconsistent state.
Soft stop
Use when: The agent is behaving suboptimally but is not causing active harm.
Let in-flight tool calls complete. Stop the agent from starting new tool calls after the current batch finishes. Return a partial result if one is available.
Tradeoff: Takes longer to fully stop. The agent may incur additional cost completing in-flight work. Appropriate for cost overruns and slow loops, not for active safety incidents.
Hard stop
Use when: The agent is taking dangerous or irreversible actions, violating scope, or causing visible user harm.
Interrupt all in-flight calls immediately. Roll back any reversible actions if compensating transactions exist. Surface the incident to the on-call team. Log everything.
Tradeoff: May leave external systems in inconsistent state. Requires compensating transaction design for each tool the agent can call. The PM must specify which actions are reversible and which are not.
The PM's role is to classify each tool the agent can call as reversible or irreversible before launch. Sending an email is irreversible. Creating a draft is reversible. Making a payment is irreversible. Generating a report is reversible. This classification drives the compensating transaction design and determines which actions require a hard stop if the kill switch fires mid-task.
Pre-Launch Checklist: Circuit Breaker and Kill Switch Requirements
These items belong in every AI agent PRD and launch review. If they are missing at launch, the incident response plan is writing the requirements under pressure.
Ship AI Agents That Hold Up in Production
The AI PM Masterclass covers agentic system design, reliability patterns, and the operational discipline that separates AI products that survive their first incident from ones that do not.
Related Articles
Before you go: get the AI PM Minute
One tactic to make you a sharper AI PM, twice a week. 60 seconds to read. Free.
No fluff. Unsubscribe anytime.