Emergency stop

An emergency stop replaces a policy's active version with a version that has no rules: either everything is denied, or everything needs a person's approval. It takes effect on the next call of every agent assigned to the policy, on every Gateway, and it cannot be blocked by any check.

Use it when agents of a policy are doing something they must not do and you need them stopped before you understand why. Once the incident is resolved, you roll back to a reviewed version.

Who can stop a policy

Only a signed-in owner or admin. No API key can trigger an emergency stop, and K-Block checks your role again at the moment it applies the stop. See Roles and permissions.

Modes

Require approval for all lets agents keep working with a person checking each call, but every call creates an approval request, which can flood your approvers. Its approvers are every owner, admin and approver with an active signing identity: if there is none, every call is denied with NO_APPROVERS, and if there are more than 32, with TOO_MANY_APPROVERS. Prefer Deny all unless you know the volume is manageable.

The stop documents always have the same digests, so you can recognize a stop in receipts and audit data:

The deny_all document is the same as an empty deny-all policy, so the same digest can also belong to an ordinary version with no rules; the version's origin (emergency) is what marks a stop.

Stop a policy

1. Open the emergency stop

   Open the policy. In the header, open the menu next to the buttons and select Emergency stop….

2. Choose the mode and the open actions

   Under What to do with every call of this policy, choose Deny all or Require approval for all. The Consequences box lists the number of agents affected and the observe windows that will end. Under Open actions of the replaced versions, keep the default or choose another option (see Open approvals and allowed calls).

3. Confirm

   Optionally add a note, type the policy's name, and select Deny every call now (or Require approval for every call now).

If another version became active while the sheet was open, the stop is refused with ACTIVE_VERSION_CHANGED and the sheet offers Stop anyway, which stops whatever is active now.

Through the API: POST /orgs/:orgId/policies/:id/emergency with mode, and optionally expected_active_version_id (omit it to stop whatever is active), note and open_actions.

What a stop does

As one change, which happens completely or not at all, K-Block:

1. creates the stop document as the next version number (origin emergency) and activates it; the previous active version becomes superseded;
2. ends every open observe window of the policy's agents (end reason emergency_stop);
3. records the policy.activated (trigger emergency) and policy.emergency_stopped audit events.

The stop is never gated: no examples, impact check or language gate applies. It keeps the policy's shadow version.

Effect on the next call, on every Gateway

Every Gateway reads the policy's active version on every call, so the next call of every agent assigned to the policy is decided by the stop, whichever Gateway serves it.

• No observe window can relax a stop: windows are ended, a window that raced the stop is ignored, and new windows are refused with 409 EMERGENCY_ACTIVE while the stop is active.
• Calls that an earlier version allowed but that have not executed yet are re-checked immediately before they run. The stop allows nothing, so they are refused with POLICY_CHANGED and nothing executes.

A stop covers one policy: every agent assigned to it, including agents moved into it later. It does not affect agents of other policies. For other ways to stop agents, such as disabling an agent or revoking a key, see Emergency controls.

Open approvals and allowed calls

You choose what happens to actions that were decided under the replaced versions and are still open:

This covers actions decided under every version of the policy activated before the stop, and those of agents moved into the policy. From the moment the stop takes effect, K-Block refuses to approve or execute a covered action. It then closes them, and closes any that remain automatically, usually within about 15 seconds. If the result reports actions still open, select Close the remaining open actions.

With Keep them, an approval a person gives after the stop can still let that earlier call execute. Choose supersede_all if nothing decided before the stop may run.

What you see

• The policy page shows Emergency stop v… as the active version and the banner An emergency stop is active.
• The Policies list shows a banner Emergency stop: … with Review and roll back.
• The Rollout tab's stepper is paused; its only next step is the rollback.
• The Versions tab shows the stop as Emergency stop: denies every call (or requires approval for every call).

Webhooks and audit

Actions closed by the stop produce their own events (for example approval.expired for closed approval requests). See Webhook events and Audit events.

Recover

Recover by putting a reviewed version back in force:

• Roll back: during a stop, the policy header shows Roll back to v… as its main button, targeting the version that was active before the stop. The rollback creates an exact copy of that version and activates it. See Roll back.
• Activate a corrected draft from the Versions tab, once you have fixed the policy. Activation goes through the usual gates.

Either way, the next call is decided by the restored or new version. Approvals and calls the stop closed are not reopened: the agent must call again and get a new decision.

Next steps