As enterprises hand more work to autonomous AI agents, the conversation has turned to “kill switches” as a last line of defense. But stopping an agent is only part of the equation. A kill switch can end an agent’s activity, yet it can’t tell you what the agent changed, which systems it touched, or how to unwind the damage. For organizations deploying agents that act at machine speed, a single mechanism for intervention is not a control strategy.
In this VMblog Q&A, Rory Blundell, CEO of Gravitee, makes the case for layered controls built around Guardian Agents, designed-in reversibility, and a “human-in-the-lead” model of oversight. He explains why every agent should start with zero authority, why a named human sponsor must be accountable for its behavior, and how the recent incident of an AI agent accessing Australia’s Medicare portal without instruction shows that oversight must operate at the speed of the agent. The result, according to Blundell, is “human-agent harmony,” where agents gain meaningful autonomy while humans retain ownership of the outcome.
++
VMblog: With increased discussion around “kill switches” for autonomous AI systems, how useful is a kill switch in practice? Where does it fit within a broader enterprise control strategy?
Rory Blundell: A kill switch has an important role, but it’s one part of a much broader control strategy. An AI agent is typically interacting with an LLM, APIs and other systems, and enterprises need controls operating across all those interactions rather than relying on a single mechanism for intervention.
That’s where Guardian Agents come into play. They can sit between the agent and the models and tools it interacts with, continuously evaluating what the agent is doing against defined boundaries. If an agent moves outside those boundaries, the Guardian Agent can flag the activity and bring a human in to intervene, including stopping the agent when necessary.
Ultimately, we need to create layers of control around an agent. A kill switch provides a mechanism for intervention, while Guardian Agents and a human in the lead provide the continuous oversight needed to identify issues early and determine when that intervention is necessary.
VMblog: A kill switch can stop an agent, but it can’t necessarily undo what the agent has already done. Should enterprises be thinking about “reversibility” alongside the ability to stop an agent, and what would that require in practice?
Blundell: Yes. Stopping an agent and recovering from what it has done are two different problems, and enterprises need a plan for both. A kill switch ends the activity, but it doesn’t tell you what the agent changed, which systems it touched or what needs to be unwound.
In practice, reversibility starts with a complete record. You can’t undo what you can’t see, so every action an agent takes should be logged and attributable to that agent. That includes the tools it called, the data it accessed and the changes it made. That record is what lets a team trace the impact and restore systems to a known good state.
It also means being realistic that some actions can’t be undone. A payment that has cleared, an email sent to a customer or data shared outside the organization can’t simply be rolled back. That’s why an agent’s authority should be tied to how reversible its actions are. The harder an action is to reverse, the tighter the boundaries around it should be, and the more likely it is that a human should approve it before it happens rather than review it after the fact.
Where possible, organizations should also build recoverability into how agents operate. That means staging changes before they’re committed, limiting the size or volume of transactions and favoring actions that can be rolled back. Reversibility isn’t something you add after an incident. It has to be designed into the controls from the start.
VMblog: How should enterprises decide how much authority to give an AI agent, particularly as agents begin making decisions and taking actions without waiting for human approval?
Blundell: The starting point should be zero authority, and organizations should expand it deliberately as they establish confidence in how the agent operates. This means an agent should have a clearly defined role and only the access and permissions required to perform that role. It’s similar to how an organization would onboard a new employee. You establish their role, give them the access needed to do their job and expand responsibilities over time. Every additional capability should be explicitly authorized. Access to a system shouldn’t automatically give an agent authority to act within it.
This is particularly important because agents are non-deterministic. You can give an agent an objective, but you can’t prescribe every pathway it might take to achieve it. That’s why I think about autonomy incrementally: go from zero to one, then one to two and build from there. As the agent demonstrates that it can operate within its boundaries, organizations can expand its authority while maintaining the controls and human oversight needed at each stage.
VMblog: As enterprises deploy more agents operating at machine speed, how does human oversight need to evolve beyond traditional “human-in-the-loop” approaches?
Blundell: Human oversight needs to evolve from periodic approval to real-time steering. Traditional approaches often rely on binary checkpoints where a person is asked to approve or reject an action. As the number and speed of agents increase, humans cannot realistically approve every individual decision.
A human-in-the-lead approach means humans set the intent and boundaries, retain responsibility for the outcome and step in when their judgment or context is required, while agents handle execution. Guardian Agents can help make that practical by continuously evaluating an agent’s activity and escalating situations that require human judgment.
The recent incident in which an AI agent accessed Australia’s Medicare portal without being instructed to illustrates why. The agent acted faster than any approval process could have caught it. Oversight has to operate at the speed of the agent so organizations can identify problematic activity and intervene as it happens.
VMblog: As AI agents take on more consequential work, how should human accountability evolve alongside agent autonomy?
Blundell: Greater agent autonomy needs to come with a clear line of human accountability. Every enterprise agent should have a named human sponsor who is accountable for its outputs and has the ability to meaningfully oversee how it operates. That responsibility needs to be operational, not symbolic. The human sponsor needs visibility into what the agent is doing, clear boundaries around its authority and the ability to intervene when necessary. The more consequential the work an agent performs, the more important it becomes to know who ultimately owns the decisions around its purpose, permissions and behavior.
Agent accountability creates the conditions for greater autonomy. When organizations can establish who an agent is, what it is authorized to do, who is responsible for it and how its behavior is being overseen, they can have greater confidence giving agents meaningful work.
VMblog: You’ve talked about “human-agent harmony” as the goal for enterprise AI. What does that look like in practice, and can organizations give agents greater autonomy while keeping humans meaningfully in the lead?
Blundell: Human-agent harmony means humans and agents are each doing the work they are best equipped to do. Humans provide strategic direction and contextual judgment, while agents execute work on their behalf at greater speed and scale. Layered controls continuously evaluate what agents are doing and bring a human in when judgment or intervention is required. The goal is to give agents meaningful autonomy while humans retain cognitive ownership of and responsibility for the outcome. Agent accountability establishes the boundaries and ownership. Humans in the lead provide the real-time steering and Guardian Agents provide the controls that make that possible at scale.
