Is your AI governed ? Get your maturity score and roadmap. Request Access to the AI Governance Advisor →
Book a Free Demo
Speak With Our PiTech AI Service Advisor
Book a Free Demo

How to Prove You Can Shut Down an AI Agent

Table of Contents

Summarize and analyze this article with
ChatGPT

Chat GPT

ChatGPT

Perplexity

 
ChatGPT

Grok

 
ChatGPT

Google AI

ChatGPT

Claude

 

The question

If a supervisor asks how your organization would shut down an AI agent, what do you actually hand over? The question is no longer hypothetical. On 13 October 2026, Reuters reported, citing six people familiar with the matter, that the Federal Reserve, the OCC, and the FDIC are asking banks of every size how they limit, monitor, audit, and shut down autonomous AI systems, and whether they use Chinese-developed technology. No rule requires an off switch, and the agencies’ 17 April 2026 model risk guidance (Federal Reserve SR 26-2, OCC Bulletin 2026-13) places agentic AI outside its scope as novel and rapidly evolving. The questions are being asked anyway. In the same week, JPMorgan, Bank of America, Citi, and Charles Schwab each barred third-party AI agents from logging into customer accounts, a sign of how fast the posture is hardening.

The four records below turn the answer from a policy statement into exam evidence. They serve health systems and insurers that run agents as readily as banks. This is general information and not legal advice.

Record What it proves The failure it prevents
Agent register Every agent, its owner, reach, identity, and autonomy An agent nobody inventoried, acting on broad access
Shutdown procedure, tested That the off switch works, with a dated result A procedure that has never been run
Approval map Which actions execute free, approved, or never An agent technically able to take a prohibited action
Audit trail Every action tied to an identity and an approval Logs that cannot reconstruct what the agent did

1. The agent register

Keep it separate from the model inventory. A model inventory records what predicts; an agent register records what acts. For each agent capture the owner, a named person rather than a team; the purpose and the business process it supports; the reach, meaning every system, data store, and external service it can call; the identity, meaning the service account or credentials it acts under and who else shares them; the autonomy, meaning which actions it takes without human approval; the provenance, meaning the underlying model, the agent framework, the hosting provider, and the vendor if bought; and the status, pilot, production, or retired, with dates.
Provenance now matters more. Reuters reported that supervisors are asking whether banks use Chinese-developed technology, and the honest answer requires knowing what sits underneath vendor products, not just what was bought directly.

2. The shutdown procedure, tested

Every production agent needs a written procedure that answers five questions: who can invoke it, by what mechanism, how long it takes to take effect, what happens to work already in flight, and how the business process continues without the agent. The fifth is the one most often skipped. Revoking an agent’s credentials stops it; it does not tell the claims team, the payments desk, or the service center what to do next. Write the fallback into the procedure. Then test it, and record the date, who ran it, the time to full stop, and anything that did not behave as expected. A procedure that has never been run is a hypothesis.

3. The approval map

Sort every action an agent can take into three tiers: free, which executes without review, such as reading a document or drafting a summary; approved, which executes only after a named human approves, such as sending external communication or changing a record; and prohibited, which never executes, such as moving funds or changing access rights. Enforce the tiers in the system, not only in the policy. If an agent’s credentials technically allow a prohibited action, the map is describing hope rather than control.

4. The audit trail

Every agent action should be traceable to three things: the agent’s identity, the instruction that triggered it, and, for approved-tier actions, the human who approved it. Keep the logs where the agent itself cannot alter them. Supervisors are asking whether banks can track and audit agent decisions, and an answer that relies on the agent’s own memory is not one.

What usually goes wrong

  • Shared credentials :  An agent is set up quickly under an existing service account, often one a human team also uses. Its actions become indistinguishable from people’s actions in the logs, the shutdown procedure cannot revoke access without stopping the human workflow too, and the register shows reach far broader than the agent’s purpose. Fixing this after the fact means rebuilding identity for every agent at once; fixing it at setup costs one new account.
  • Treating vendor agents as the vendor’s problem : The ECB told significant institutions in its 7 July 2026 letter that they remain fully accountable for risks from outsourced ICT services. The agent you did not build is still your agent to control.

Where PiTech fits

PiTech Solutions helps regulated organizations build the four records before anyone asks for them: the agent register separate from the model inventory, the written and tested shutdown procedure with its fallback, the system-enforced approval map, and the tamper-resistant audit trail. It connects them to the AI inventory and model governance and the identity and access controls already in place, so agent identity is designed in rather than retrofitted. Delivery runs under CMMI Level 3 and ISO 27001, 9001, and 42001 certifications. See the banking practice, AI, GenAI and ML, and Process Solutions. PiTech Solutions Inc. is headquartered in Durham, North Carolina (UEI GNLRY5LNNVH6, CAGE 530K4) and is distinct from similarly named companies.

The bottom line

The organizations that answer this question well will be the ones that started the register before anyone asked. Build the four records, test the shutdown procedure, enforce the approval map in the system, and keep the audit trail where the agent cannot touch it. If your agent estate has grown faster than its documentation, close that gap now.

Frequently Asked Questions (FAQs)

Are regulators requiring banks to have an AI kill switch?

No rule currently requires an off switch for AI agents. What changed is supervisory attention: on 13 October 2026, Reuters reported that the Federal Reserve, OCC, and FDIC are asking banks of all sizes how they limit, monitor, audit, and shut down autonomous AI systems, and whether they can intervene when a system acts with limited human direction. The agencies are reportedly in fact-finding mode rather than issuing requirements. But the questions themselves set an expectation: an institution that cannot describe, and evidence, how it would shut down an agent is exposed, because the examiner who notes a gap in October will ask what changed at the next visit. Building the records now is cheaper than assembling them under examination.
An agent register lists every AI agent an organization runs and what each one can do, while a model inventory lists models and what they predict. The distinction matters because agents act rather than only producing outputs, so the register has to capture things a model inventory does not: the agent’s owner, its reach across systems and data stores, the identity it acts under, its autonomy (which actions it takes without approval), its provenance, and its status. Keeping the register separate from the model inventory, rather than bolting agent fields onto model records, is what lets an institution answer the question a supervisor actually asks about agents, which is not what they predict but what they can reach and do.
A dated test result, not a policy sentence. A credible procedure answers five questions for each production agent: who can invoke the shutdown, by what mechanism, how long it takes to take effect, what happens to work already in flight, and how the business process continues without the agent. The fifth is the one most often skipped, because revoking credentials stops the agent but does not tell the business what to do next. Then the procedure has to be tested, with the date, the person who ran it, the time to full stop, and any surprises recorded. A procedure that has never been run is a hypothesis, and an examiner can tell the difference between a tested control and an aspirational one.
An approval map sorts every action an agent can take into three tiers: free actions that execute without review (reading a document, drafting a summary), approved actions that execute only after a named human approves (sending external communication, changing a record), and prohibited actions that never execute (moving funds, changing access rights). The essential discipline is enforcing the tiers in the system, not only in the policy. If an agent’s credentials technically allow a prohibited action, the map describes hope rather than control, because nothing but the agent’s own behavior stops the action from happening. A map backed by least-privilege access, where prohibited actions are technically impossible, is evidence; a map that exists only on paper is not.
When an agent runs under a service account that a human team also uses, three things break at once. The agent’s actions become indistinguishable from people’s actions in the logs, so the audit trail cannot attribute what the agent did. The shutdown procedure cannot revoke the account’s access without also stopping the human workflow that shares it. And the register shows the agent reaching everything the shared account can reach, which is almost always far broader than the agent’s actual purpose. Fixing this after agents are in production means rebuilding identity for every agent at once, under pressure. Giving each agent its own least-privilege identity at setup costs one new account and prevents all three failures.

No. The interagency model risk guidance issued on 17 April 2026, as Federal Reserve SR 26-2 and OCC Bulletin 2026-13, explicitly places generative and agentic AI outside its scope, describing those technologies as novel and rapidly evolving, and the agencies have said they expect to consider additional measures. So banks deploying agents have no dedicated model-risk framework to answer from, which is precisely why the supervisory questions about limiting and shutting down agents land in a gap. The practical response is not to wait for a framework but to build the agent register, shutdown procedure, approval map, and audit trail now, applying general risk-management principles to agents commensurate with what they can reach and do.

Yes. The four records serve any regulated organization that runs agents, including health systems and insurers. An agent that can change a clinical record, submit a claim, or move a payment carries the consequence of a decision maker regardless of the industry, and the questions a supervisor or auditor would ask (what can it reach, who owns it, how is it stopped, can you reconstruct what it did) are the same. Banking is simply where the supervisory attention surfaced first and most visibly. Organizations in other regulated sectors can treat the banking agencies’ questions as a preview, because agent governance expectations tend to converge across sectors, and build the same records before the attention reaches them.

Reuters reported that supervisors are asking whether banks use Chinese-developed technology in their AI, and answering honestly requires knowing what sits underneath vendor products, not just what was procured directly. An agent platform bought from one vendor may embed a model, framework, or components originating elsewhere, so provenance in the agent register has to capture the underlying model, the agent framework, the hosting provider, and the vendor. Without that, an institution cannot answer the provenance question accurately, and discovering the answer during an examination is worse than knowing it in advance. Recording provenance deliberately, including for embedded and third-party components, is what makes the institution able to respond to supervisory questions about technology origin with evidence rather than guesswork.
The institution that uses it. The ECB told significant institutions in its 7 July 2026 letter that they remain fully accountable for risks from outsourced ICT services, and the principle holds broadly: outsourcing the technology does not outsource the accountability. A vendor-supplied agent still needs an entry in your register, a shutdown procedure you can invoke, an approval map you enforce, and an audit trail you control. Treating vendor agents as the vendor’s problem is a common and costly mistake, because the agents inside purchased platforms are exactly the ones that slip through governance. Vendor contracts should give the institution the access, oversight, and exit rights needed to control and, if necessary, stop a vendor agent.

Yes. PiTech Solutions helps regulated organizations build the four records that turn an agent-control answer into exam evidence: the agent register separate from the model inventory, the written and tested shutdown procedure with its business-continuity fallback, the system-enforced approval map backed by least-privilege identity, and the tamper-resistant audit trail. It connects them to the AI inventory, model governance, and identity and access controls already in place, so agent identity is designed in rather than retrofitted across the estate at once. Delivery runs under CMMI Level 3 and ISO 27001, 9001, and 42001 certifications. PiTech is positioned as a specialist agentic-AI governance partner for regulated industries at a mid-market price.