> ## Documentation Index
> Fetch the complete documentation index at: https://docs.amrood.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Kill Switches

> Emergency freeze, quarantine, and containment controls

# Kill Switches

Amrood provides multiple levels of containment for suspicious or compromised accounts.

## Agent States

| State           | Can Receive | Can Send | Use Case                                      |
| --------------- | ----------- | -------- | --------------------------------------------- |
| **active**      | Yes         | Yes      | Normal operation                              |
| **paused**      | No          | No       | Temporary stop by owner                       |
| **quarantined** | Yes         | No       | Under investigation — prevents fund dispersal |
| **frozen**      | No          | No       | Emergency lockdown                            |
| **deactivated** | No          | No       | Permanently disabled                          |

## Owner-Level Freeze

Freezing an owner instantly freezes **all** agents under that owner:

```bash theme={null}
POST /v1/admin/owners/own_xxx/freeze
```

Unfreezing restores all frozen agents to active:

```bash theme={null}
POST /v1/admin/owners/own_xxx/unfreeze
```

## Bulk Agent Operations

Freeze or quarantine multiple agents at once:

```bash theme={null}
# Bulk freeze
POST /v1/admin/agents/bulk-freeze
{
  "agent_ids": ["agt_aaa", "agt_bbb", "agt_ccc"]
}

# Bulk quarantine
POST /v1/admin/agents/bulk-quarantine
{
  "agent_ids": ["agt_aaa", "agt_bbb", "agt_ccc"]
}
```

## Quarantine Mode

Quarantine is a special state designed for investigation:

* Agent **can receive** payments (prevents senders from knowing the agent is flagged)
* Agent **cannot send** payments (prevents further fund dispersal)
* Policy engine blocks all outbound transactions with reason `"Agent is quarantined"`

## Defense Layers

```mermaid theme={null}
flowchart LR
    A["Real-time Risk Score"] --> B["Policy Engine"]
    B --> C["Graph Analysis"]
    C --> D["Admin Review Queue"]
    D --> E["Kill Switch"]
```

1. Real-time scoring catches obvious patterns instantly
2. Policy engine enforces velocity and counterparty limits
3. Graph analysis catches coordinated multi-agent patterns
4. Admin reviews flagged alerts and takes containment action
5. Kill switches provide immediate containment

## Cooldown on Limit Changes

When an agent's spending limits are increased, a mandatory cooldown period (default 24 hours) prevents immediate use of the higher limits. This protects against compromised accounts quickly raising limits and draining funds.