---
sourceDocument: Brazil Enable AI
sourceDocumentLink: https://www.servicenow.com/docs/r/intelligent-experiences

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Enable AI

ft:clusterId :

    - platai

bundleId :

    - platai

workflow :

    - Platform


---

# Contain AI agents manually using kill switch protocol

# Contain AI agents manually using kill switch protocol {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Deactivate or reinstate AI agents using kill switch protocol to help improve your security posture and stop malicous activity.

## Before you begin

Role required: sn_ai_security.operator or sn_ai_governance.ai_steward

Make sure that you have configured connectors and optional identity providers for AI agent containment. For more information, see [Configure AI agent containment using kill switch protocol manually](https://www.servicenow.com/docs/iDtE_Oa78sQsNv89R5lHVA "Connect identity providers and AI agent platforms to ServiceNow to let you contain and enforce guardrails for AI assets at runtime using kill switch protocol.").

## About this task

You can manually deactivate an AI agent two ways. If a security event is detected for the agent, a banner appears indicating that malicious activity was detected for the AI asset, offering deactivation, as described in the
following steps.

You can also manually deactivate any managed AI agent directly, whether or not it has an associated security event, by opening the AI asset record and, from the Actions menu, selecting
Deactivate Agent. This option is available only for managed AI agents. For details, see [Deactivate a managed AI agent](https://www.servicenow.com/docs/U88WshH77IDnxqPzAVXycA "Deactivate a managed AI agent directly from its asset record using kill switch protocol, even if the agent has no associated security event.").  
Note:  
To contain AI agents automatically through policy enforcement, see [Controlling AI asset usage in AI Control Tower](https://www.servicenow.com/docs/nwz0uWCGkPLBpaunLo1RTQ "Create AI asset usage policies that automatically respond to detected AI threats or block an AI agent, domain, or model outright.").

## Procedure

1. In AI Control Tower, navigate to one of the following:
   * GovernSecurityOverviewYour top recommendations
   * Activity CenterRecommendations
   * The AI asset record's Overview tab or Security tab, for AI agents in the Agentic AI category.
2. Open an AI asset event of any severity (Critical, High, Medium, or Low).
3. Select and view the AI asset associated with the critical event.  
   A banner appears informing you that there is malicious activity detected for this AI asset.
4. On the banner, select View containment options.  

   <br />

   A pane appears with information about the activity detected for this AI asset.
5. Select Deactivate.
6. Provide the reason for the deactivation and select Deactivate.  

   <br />

   The banner on the AI asset changes to reflect the progress of deactivation.
7. **Optional:** If the deactivation status shows as Failed or Partial, select Retry on the banner.
8. Select View agent containment list to track the progress of the deactivation.  

   <br />

   For more information, see [Review the agent containment list](https://www.servicenow.com/docs/GSRRWm_yuZKNcfx0aLGe~Q "The agent containment list shows agents that were deactivated and reinstated for the instance manually with kill switch protocol or automatically by policy enforcement. You can view audit log information for each AI agent which can help you stay compliant with regulatory guidance and your business rules.").
9. After deactivation is complete, you can reinstate the AI agent by resolving the critical security task for the AI agent first.
10. Navigate to SecurityOverviewContained AI Agents.
11. In the AI agent row, under Actions, select Reinstate.
12. Enter a reason for reinstating the AI agent and select Reinstate.
* **[Review the agent containment list](https://www.servicenow.com/docs/GSRRWm_yuZKNcfx0aLGe~Q)**   
  The agent containment list shows agents that were deactivated and reinstated for the instance manually with kill switch protocol or automatically by policy enforcement. You can view audit log information for each AI agent which can help you stay compliant with regulatory guidance and your business rules.

*[\>]: and then