Financial service institutions: Securing AI agents starts with a kill switch you control

Gartner just released a forecast that spending on securing AI ecosystems and AI agents will rise from $2.8 billion this year to $4.7 billion by the end of next year. Gartner’s argument is that enterprises need to govern how AI agents behave and act, enforce policy on them, and monitor risk while they are running.

Gartner also expects that by 2029, more than half of successful attacks on AI agents will exploit weak access controls and prompt injection. The research puts numbers on what we are hearing in our own customer conversations in financial services and in recent analyst briefings. AI has made writing code fast, so more changes are shipping, and teams need a way to contain the fallout that does not depend on shipping new code, because slowing down AI adoption is a non-starter.

Prompt scanners and AI gateways sit upstream of deployed code and are important controls. But neither one tells you what to do when the agent running a critical service like loan origination misbehaves in a non-deterministic way. That is what a kill switch is for.

Why a kill switch is the most practical control available today

Kill switches, implemented as feature flags, are the most practical control available today for changing the behavior of agentic systems in real time. Putting an AI-generated change behind a kill switch flag means the fallback to a known good state is written into the application before the change ever ships.

That known good state has already been tested by definition, because it is the path that was running before the new agent shipped. Turning the behavior off takes seconds, requires no deployment, and can be done with or without a human in the loop. Deploying a new version of the agent instead takes hours.

Google and Cloudflare both landed on the same conclusion

Two of the most sophisticated infrastructure teams in the world know how long it takes to fix issues in production using automated deployments. Google’s postmortem on its June 2025 outage noted the change would have been caught had it been behind a feature flag, and Cloudflare committed to enabling more global kill switches after its November outage. They are making the case for Kill Switches.

What this looks like in practice

In our loan origination example, if loans are approved that do not meet the underwriting criteria of the deterministic system, rather than turning off the service entirely, a kill switch can revert to the rules-based approach that was used for the last several years while the source of the divergence is investigated.

The same pattern applies to any AI-generated change

The same model applies broadly to AI-generated code and agentic systems.

• A new AI-generated capability ships: add a kill switch that reverts to the previous version.
• A new model version replaces a stable one in an agentic process: add a kill switch that reverts to the previous model.
• An agent is granted write access to a new system: put that write path behind a flag so the access can be revoked instantly, without a redeploy until fully validated.

Four questions to ask about a workflow already in production

The EU AI Act and operational resilience rules are both pointing to the need to control AI applications and AI code end-to-end. As a thought exercise, take one agentic workflow already in production and ask four things:

1. Can we turn this off in seconds without deploying new code?
2. Who is allowed to approve those changes?
3. Would the audit trail satisfy a regulator?
4. Who controls the kill switch system itself and will it work when you need it to?

 

Unleash is the FeatureOps platform used by financial services institutions like Visa, Lloyds Bank and Prudential to meet the demands of an AI-driven SDLC. Let us help you.