> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amrood.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Kill Switches

> Emergency freeze, quarantine, and containment controls

# Kill Switches

Amrood provides multiple levels of containment for suspicious or compromised accounts.

## Agent States

| State | Can Receive | Can Send | Use Case |
| - | - | - | - |
| **active** | Yes | Yes | Normal operation |
| **paused** | No | No | Temporary stop by owner |
| **quarantined** | Yes | No | Under investigation — prevents fund dispersal |
| **frozen** | No | No | Emergency lockdown |
| **deactivated** | No | No | Permanently disabled |

## Owner-Level Freeze

Freezing an owner instantly freezes **all** agents under that owner:

```bash theme={null}
POST /v1/admin/owners/own_xxx/freeze
```

Unfreezing restores all frozen agents to active:

```bash theme={null}
POST /v1/admin/owners/own_xxx/unfreeze
```

## Bulk Agent Operations

Freeze or quarantine multiple agents at once:

```bash theme={null}
# Bulk freeze
POST /v1/admin/agents/bulk-freeze
{
  "agent_ids": ["agt_aaa", "agt_bbb", "agt_ccc"]
}

# Bulk quarantine
POST /v1/admin/agents/bulk-quarantine
{
  "agent_ids": ["agt_aaa", "agt_bbb", "agt_ccc"]
}
```

## Quarantine Mode

Quarantine is a special state designed for investigation:

* Agent **can receive** payments (prevents senders from knowing the agent is flagged)
* Agent **cannot send** payments (prevents further fund dispersal)
* Policy engine blocks all outbound transactions with reason `"Agent is quarantined"`

## Defense Layers

```mermaid theme={null}
flowchart LR
    A["Real-time Risk Score"] --> B["Policy Engine"]
    B --> C["Graph Analysis"]
    C --> D["Admin Review Queue"]
    D --> E["Kill Switch"]
```

1. Real-time scoring catches obvious patterns instantly
2. Policy engine enforces velocity and counterparty limits
3. Graph analysis catches coordinated multi-agent patterns
4. Admin reviews flagged alerts and takes containment action
5. Kill switches provide immediate containment

## Cooldown on Limit Changes

When an agent's spending limits are increased, a mandatory cooldown period (default 24 hours) prevents immediate use of the higher limits. This protects against compromised accounts quickly raising limits and draining funds.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.