Treat an AI agent as a bounded process
The choice: make stopping an inherent property of the setup
Treat an agent that calls tools as a software process with a defined task, not as a text interface with good intentions. The practical choice is therefore: a separate runtime, minimal task permissions, short-lived credentials, a restricted network path, and a stop route that an operator rehearses in advance. This is particularly relevant once an agent can access systems or data; it does not mean that every current agent resists being shut down. For high-risk AI, the European Commission describes, among other things, risk assessment and mitigation, logging for traceability, and documentation. These obligations apply within the high-risk-system category described there; they are not a general technical standard for every agent. They do, however, support the design principle that control and traceability belong in the workflow from the outset.
Isolation does not prevent every incident, but it reduces the blast radius
A sandbox is useful only if the surrounding access is also bounded. For each task, explicitly specify which tool, data, network destination, and credential are required, and block everything else. Use an account without employee permissions and let credentials expire as soon as the task ends. The NVD description of FastGPT reports that the agent sandbox in versions 4.14.10 through before 4.14.13 was vulnerable to unauthenticated remote code execution because code-server was bound to all network interfaces without authentication; users with network access could thereby gain full control of the sandbox. This is evidence about that specific configuration and those versions, not evidence that sandboxes are generally insecure. It does, however, make clear why network exposure and authentication are separate control points.
Document the stop test before the agent reaches production
Choose one workflow and perform a controlled stop test while the agent is executing a tool action, queue task, or external call. Then verify that execution stops, access is revoked, follow-up work does not restart, and the log shows who performed the action and who confirmed the stop. The tool is a decision register: record the workflow, owner, task permissions, permitted network destinations, credential expiry date, most recent stop test, log location, and follow-up decision. This makes ownership verifiable instead of a general governance promise. The source base is limited to a European description of obligations for high-risk AI and one vulnerability report about a specific FastGPT configuration; they do not substantiate a complete threat model, legal classification, or guarantee that a stop procedure works in every architecture.
