Make stopping easy and restarting hard. Any person on a short named list can suspend an agent with one control, at any hour, without asking permission. The suspension stops new actions, keeps held items for people, and switches customers to a human route. Restarting needs the process owner and risk to agree, and usually starts at a lower depth.
What does suspension mean, and who may do it?
Suspension stops an agent from acting while its record and held work are kept. It is different from retiring an agent, which is permanent, and from a single refusal, which stops one action. You suspend when the agent may be causing harm at scale: wrong payments, misleading customers, leaking data, or acting on manipulated input.
The power to suspend should be wide: the process owner, the agent operations lead, the duty security officer and the duty operations manager, all named, with cover around the clock. The power to restart should be narrow: the process owner with risk's agreement. This asymmetry is deliberate. A suspension that waits for approval arrives after the damage.
What levels of suspension should exist?
- Pause a capability: one capability stops, the rest continue. Use it when the problem is clearly limited, such as one letter template.
- Suspend the agent: no new actions of any kind; held items stay for people; customer conversations hand over.
- Revoke access: the agent's identity and credentials are disabled in every system. Use it when you suspect the agent or its credentials are compromised, or when an agent outside your platform cannot be stopped any other way, as with shadow AI agents.
What are the steps?
- Person, anyone on the list: decides to suspend and chooses the level, recording a one-line reason.
- Person, same: uses the suspension control. One action, documented and rehearsed, not a series of configuration changes.
- Agent, depth 1: confirms it stopped. Any action it proposes after suspension is refused and filed, which proves the suspension holds.
- Agent, depth 3: switches customer channels to a pre-written hand-over message and routes conversations to people.
- Person, agent operations lead: contains in-flight work. Decide for each action already executing whether to let it finish or reverse it, and check outbound queues such as payment files or scheduled emails.
- Person, agent operations lead: preserves the record, marking the period for investigation.
- Person, process owner: notifies affected teams, and the incident process starts.
- Person, process owner, with risk: decides on restart, including whether re-certification is needed and at what depth to resume.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Decide | Nothing | none | Choosing to suspend and the level |
| Suspend | Nothing | none | Using the control |
| Confirm | Its proposed actions are refused | 1 | Checking refusals appear |
| Hand over | Switches channels to people | 3 | Staffing the hand-over |
| Contain | Nothing | none | Finishing or reversing in-flight work |
| Preserve | Nothing | none | Marking the record |
| Notify | Nothing | none | Telling teams and starting the incident |
| Restart | Nothing | none | Owner and risk decision |
Which decisions does a named person keep?
To suspend. No approval needed, but always a named person, never an automatic trigger alone. Automatic pauses on specific capabilities are useful; full suspension should be a person's call.
What happens to in-flight actions. A payment half-processed or a batch of letters in the print queue needs a judgement about the least harmful option.
To restart. The process owner and risk agree, with the cause understood. Restarting before the cause is known invites the same problem.
At what depth. Many firms restart at depth 1 or 2 and widen again only after fresh evidence.
What record does it produce?
The suspension record holds who suspended, when, at what level and why; the refusals proving the agent stopped; the hand-over activation; the in-flight decisions; the notifications; and the restart decision with its conditions. These records feed the incident report and the next certification.
Which controls make suspension work?
Rehearsal. Suspend each agent in a test environment, and periodically in production during quiet hours, so the control and the people are proven.
Held items survive. Suspension must not discard the held queue or approve it automatically.
Tools can be cut independently. If a tool is being misused, removing access to that tool may be enough; the techniques are in how do you protect an AI agent's tools from misuse?
The agent's own caution comes first. An agent that stops and escalates when unsure reduces the number of emergencies; see what should an AI agent do when it is unsure?
What should you measure?
Time from decision to confirmed stop, time to activate the hand-over, rehearsals completed per agent, suspensions by cause, and time from suspension to a restart decision. If confirmed stop takes more than minutes, fix the control before you need it.
Where does it usually go wrong?
Nobody knows who may suspend. The duty manager sees the problem at night and waits for the owner. Publish the list.
Suspension is many steps. Disabling the agent means editing several systems, and one is missed.
Customers hit a dead end. The agent stops and the chat window shows an error. Prepare the hand-over message and the queue in advance.
Restart is rushed. Pressure to clear the backlog brings the agent back at full depth before the cause is fixed.
Other agents carry on. An agent coordinating the suspended one keeps sending it work, or another agent with the same flaw keeps running. Check related agents.
Where Pryme fits
In Pryme, suspension stops new actions while held items stay with named people, and every refused attempt during suspension is filed. Restarting draws on certification: a run that clears no depth drops the agent to depth 1 the same day, and depth returns only with fresh evidence. More in agent governance is a bound, not a model.
Questions people ask
Should suspension be automatic when something goes wrong?
Automatic pauses on a capability are sensible for clear signals, such as repeated refusals at the same bound. Full suspension of an agent is better as a quick human decision, because false alarms that stop whole services erode trust in the control.
Does suspending an agent delete anything?
No. The record, the held queue, the brief and the certificate history stay. Suspension stops acting, not remembering.
Who tells customers?
The process owner decides with communications and compliance whether customers need to be told beyond the hand-over message, depending on what the agent did before it stopped.