Agentic Data Plane

Contain Agents Automatically

A kill switch policy watches one of an agent’s safety signals and records a firing when that signal spikes. In Observe mode, the policy only records the firing. In Enforce mode, each firing contains the agent until it’s released. Create policies in Observe, check their firings against what really happened, and promote them to Enforce once you trust them. For how policies decide to fire, see How kill switch policies decide.

After reading this page, you will be able to:

  • Create a kill switch policy and tune it against the agent’s history

  • Promote a policy from Observe to Enforce

  • Edit or delete a kill switch policy

Prerequisites

  • Permission to create and change kill switch policies. Only the Full access template and the Admin role grant it. See Permissions.

  • A source for the signal you want to watch:

Check the agent’s signal sources

  1. Open Agents in the sidebar and select the agent.

  2. Click the Govern tab.

The tab shows two cards that describe what produces this agent’s signals:

  • Guardrails: The guardrails that run on the agent’s LLM provider, and how many requests they blocked in the last 7 days. A paused guardrail is labeled Paused.

  • Data policies: The data policies on the agent’s MCP servers, and how many data access attempts they denied in the last 7 days. The MCP server’s owner sets these policies, so they’re labeled Always on.

A card labeled None configured, No MCP servers, or None defined has no source for that signal, and a policy that watches it can’t fire. Use the card’s buttons to add a source first. For a self-managed agent, the cards read Per provider and Per server, because a self-managed agent chooses its LLM provider per request and brings its own MCP credentials.

Create a policy

On the agent’s Govern tab, click Create policy, then work through the editor’s sections. Nothing takes effect until you click Save policy.

  1. Enter a name for the policy. Agentic Data Plane derives the policy ID from the name and shows it as you type. The ID starts with a lowercase letter, uses only lowercase letters, numbers, and hyphens, and can’t be changed after you create the policy.

  2. Under Signal and detection, choose what to watch and how:

    • For Signal, select Guardrail block rate, Data policy deny rate, or Evaluation error rate.

    • For Detection, select Burst to fire when one window clearly exceeds the threshold, or Drift to fire when the rate stays above normal long enough to build evidence.

  3. Under Sensitivity, select a preset. The editor shows the values the preset sets. To set them yourself, click Edit values. For what each value means, click About these settings.

    • Low: Fires only on clear incidents. Slowest detection.

    • Medium: Balances detection speed and false positives. This is the default.

    • High: Fastest detection. More false positives on bursty traffic.

  4. Under Backtest, check how the policy would have behaved. See Read the backtest.

  5. Under Mode, select Observe, the recommended option, to record firings without interrupting the agent, or Enforce to contain the agent on each firing.

  6. Click Save policy.

The policy appears in the Kill switch policies table on the Govern tab.

If nothing on the agent produces the signal you chose, the backtest is replaced by a No source for this signal message and you can’t save the policy. Add a guardrail or an MCP server with data policies, or choose a different signal.

Read the backtest

The backtest replays the agent’s last 7 days of signal history under the settings you chose. The chart shows:

  • Observed rate: The share of calls with this signal in each window. Gaps are windows that weren’t evaluated, not zero.

  • Low estimate: For Burst, a conservative estimate of the rate at the confidence you chose. Burst fires when the low estimate exceeds the threshold.

  • Threshold or Evidence to fire: The line the policy fires at. For Drift, the chart also plots the accumulated evidence, which builds while the rate stays above normal plus slack and drains in healthy windows.

  • Would have fired: A marker for each window where the policy would have fired. Select a marker to see the details of that firing.

You can drag the Threshold or Evidence to fire line on the chart to change its value. Dragging marks the preset as modified. To go back to the preset’s values, click the reset button that names it, for example Reset to Medium.

When you create a policy and the agent has enough history, the editor sets the starting threshold from that history, aiming for at most 5 firings in 7 days. It stops doing so once you adjust the values yourself.

Use the count of firings to judge the settings. Frequent firings usually mean the threshold sits within normal noise. Zero firings can mean the agent was healthy, or that the threshold is too high to catch anything. A backtest shows past behavior, not a guarantee of future behavior.

If the signal history can’t be loaded, you can still save the policy without a backtest.

Choose a mode

New policies start in Observe. Keep them there until their firings match real incidents.

A Burst policy in Enforce mode fires on a single spike, and a prompt injection can cause one deliberately. For an Enforce policy, use Drift, which fires only on sustained shifts, unless you need the fastest possible reaction.

Evaluation error rate policies run in Observe only, so Enforce isn’t available for them.

Review firings

The Govern tab shows how each policy has behaved:

  • The Kill switch policies table lists each policy’s signal, detection method, sensitivity, and mode, how many times it would have fired in the last 7 days, and when it last fired.

  • The Recorded firings table lists each actual firing with its detection window, policy, detection method, and outcome. An Observe policy’s firing reads Recorded only. An Enforce policy’s firing reads Contained.

A policy in Enforce mode contains the agent with a reason that names the policy, the detection method, and the rate it detected. See Release a contained agent.

The agent’s Settings tab summarizes its coverage in a Govern section: No policy when automatic containment is off, Observing when every policy is in Observe, and Enforcing when at least one policy is in Enforce.

Promote a policy to Enforce

A contained agent stays cut off from AI Gateway until someone with the Full access template or the Admin role releases it with rpk ai. Before you promote a policy, make sure someone with that access can respond to a firing. See Release a contained agent.

When a policy in Observe fires only when it should, promote it:

  1. On the agent’s Govern tab, find the policy in the Kill switch policies table and click Promote to Enforce.

  2. Review the dialog. It shows how many times the policy would have fired in the last 7 days, or warns you that the policy is untested if there’s no signal history.

  3. Click Promote to Enforce, or click Tune policy to open the editor and adjust the policy first.

From then on, each firing contains the agent until it’s released.

To move a policy back to Observe, edit it and select Observe under Mode.

Edit or delete a policy

On the agent’s Govern tab, find the policy in the Kill switch policies table:

  • To change it, click Edit. The editor shows the policy’s current settings and backtest. Click Save policy to apply your changes.

  • To remove it, click the delete icon and type delete to confirm. Deleting a policy doesn’t release an agent that the policy already contained.

Next steps