Keep an off switch for each agent operator

How to do it

Store blocked operators in a setting the app reads at least once a minute, such as a feature flag or a database row. Answer a blocked operator with 403 and a short reason in the body. Revoke the access tokens of its clients too, as Let users revoke one agent without the others says. Log who flipped the switch and why. The same idea for your own agent is Keep a switch that turns the agent off.

Examples

JavaScript example

export async function refuseBlockedOperator(req, res, next) {
  if (req.agentOperator && (await settings.blockedOperators()).has(req.agentOperator)) {
    return res.status(403).json({ error: 'agent_blocked', message: 'This agent operator is blocked. Contact support@example.com.' });
  }
  next();
}

Python example

async def refuse_blocked_operator(request, call_next):
    operator = request.state.agent_operator
    if operator and operator in await settings.blocked_operators():
        return JSONResponse({"error": "agent_blocked",
                             "message": "This agent operator is blocked. Contact support@example.com."}, status_code=403)
    return await call_next(request)

How to check

On staging, block a test operator in the setting. Within 5 minutes its signed requests get 403, another operator's requests still get 200, and the audit log names who blocked it.

Related rules

• AGT-9 Let users revoke one agent without the others in Agents as users
• SEC-95 Keep a switch that turns the agent off in Adversarial testing