Agents call other agents
One request can set off a chain. A customer-facing assistant takes a request. It calls a payments agent. The payments agent calls the ledger and moves £48,000. Three actors, one piece of work, and only the first one is the agent anyone was watching.
Once an assistant can delegate to a specialist, the population of agents doing work grows without a human deciding to grow it. The agent nobody registered may have been invoked by an agent that was. The question is how to stop a piece of work, not how to stop one agent.
This is the Stop step of the Verify-Enforce-Stop-Prove test.
Revoke one agent, or stop the chain
The usual answer is to revoke the misbehaving agent. That has a hole in it.
| Revoke one agent | Stop the chain with KPATH | |
|---|---|---|
| Assistant agent | Revoked | Stopped |
| Payments agent, started by the assistant | Still running | Stopped |
| Ledger, £48,000 transfer | Sent | Refused |
| Credentials the chain relied on | Still valid until expiry or rollback | Withdrawn with the stop |
| Afterwards | No record that the work stopped | Containment proof: nothing in this chain was authorised after the stop |
Revoking a single agent leaves everything it already started still running. The assistant is shut off, but the payments agent it delegated to is mid-call with a live credential, and the transfer goes through.
Stopping the chain stops the assistant and everything it set in motion, and the chain loses the credentials it was relying on. Every agent and action descending from the original request is refused from the moment of the stop.
Why KPATH can do this
Two design choices make whole-chain containment possible.
First, KPATH governs the chain as one piece of work. Because every call passes through KPATH, the delegation chain is part of the request envelope KPATH governs: which agent asked which, on whose original request. The record shows who asked whom.
Second, agents carry no credentials. KPATH adds the real credential for each system on an allowed call. So when a chain is stopped, there is nothing to revoke inside the agents and nothing to wait out. The next call from any agent in the chain is simply refused, and no credential is added. The stop takes effect immediately and stays in effect without waiting for a credential to expire or a deployment to roll back.
The kill switch
Any agent, or a whole chain of agents, can be stopped immediately. Pause or kill one agent, or a whole chain mid-flight, credentials included. Each agent becomes a governed identity with an owner, a risk tier, a lifecycle, and a switch that turns it off.
Behaviour watch
Not every stop is a person pressing a button. An agent that starts acting out of pattern gets flagged: a sudden burst of calls, reaching for systems it never used, a run of refusals, or a credential turning up where it should not. High-risk agents are paused automatically. Lower-risk agents are flagged for a person to decide.
Containment proof
Stopping the work is half of containment. The other half is proving the stop held.
After a chain is stopped, KPATH produces a record anyone can check showing that nothing in that chain was authorised after the stop. The proof lives in the same signed, tamper-evident audit log as every other decision, and it can be verified offline without trusting KPATH. A regulator, an incident reviewer or a counterparty can confirm the stop from the record rather than from your word.
The regulator’s fourth question
Supervisors hold an agent that moves data or money to the same standard as the person who used to do the job. The questions follow in order: who is this agent, what is it allowed to do, what did it actually do, and how do we stop it, now. The fourth question is the one most estates cannot answer while a chain is in flight. Whole-chain kill is the answer.