Problems · in production

When an agent goes wrong mid-run, your only stop is the whole fleet.

When an agent misbehaves in production, most teams can watch the dashboard or shut everything down, with nothing in between.

live-run · activity schema example
Illustrative fleet, one agent breaching mid-run
Agents running 41
refund-agent · run 883 credit above schema limit
Action held for review
Escalated to on-call owner, 40 seconds
Rest of fleet untouched, still running
one agent stopped mid-run; the other forty never noticed
§01 / THE SYMPTOM you see: the signals
TL;DR

Dashboards report; they do not stop anything. Define an activity schema per agent, and a breaching run can be held, escalated or blocked mid-run, one agent at a time, while the rest of the fleet keeps working.

The symptom

What no stop button looks like

The failure is not that agents misbehave. It is that when one does, nothing short of a full shutdown can reach it.

01
Dashboards report, they do not intervene

You learn about the bad action after it completed. The chart that shows the spike has no lever attached to it, because observability tools are read-only by design.

02
Deployments run on trust

The agent ships with a prompt asking it to behave and nothing that enforces it on a live run. Teams describe their own setup as trust and hope.

03
The only stop is a full stop

Stopping one misbehaving agent means taking down the deployment it shares with everything else. The blast radius of intervening is so large that nobody pulls the lever.

04
Policies live on paper

A document says what each agent may do. No mechanism checks a live run against it, so the policy constrains the authors and never the agent.

§02 / WHY IT HAPPENS cause: not carelessness
Why it happens

Why nothing can intervene

Stopping a live agent was never designed in. Each layer of the stack assumed someone else would do it.

01
Observability was built to read

Tracing tools record what happened and deliberately stay out of the request path. Intervention was out of scope on day one, so no amount of dashboards adds a brake.

02
"Allowed" was never machine-readable

What the agent may do exists as a policy document and a prompt, not as a schema a machine can check. There is nothing to evaluate a live run against.

03
The smallest stoppable unit is the deployment

Agents ship on infrastructure where you can stop a service or nothing. A single run, or a single agent among many, is not a thing the platform can halt.

04
Escalation has no path

Even when a person spots a bad run live, there is no route from the alert to someone with the authority to pause it before the action completes. By the time the meeting happens, the run has finished.

§03 / HOW YOU CATCH IT loop: observe → evaluate
How you catch it

How a run gets checked while it runs

Prefactor evaluates every run against the agent's activity schema as it happens, so a breach becomes a signal with authority attached, not a line in next week's report.

Connect

Instrument the agents you already run. Native SDKs for common frameworks, a TypeScript and Python core SDK for anything custom, and OpenTelemetry ingest for closed tools. Actions land in the record as they happen.

Define

An activity schema per agent. The actions, data, and limits its job allows, written as a schema a machine can check, not a paragraph a person once read. The paper policy becomes an enforceable one.

Evaluate

Every run checked against its schema, live. Each action is evaluated as the run progresses. An agent inside its schema is never interrupted; an action outside it is caught before it completes, not counted after.

Surface

Breaches arrive as decisions, not charts. A breach reaches a person with options attached: hold, escalate, or block. The threshold that triggers it is yours to set per agent.

§04 / HOW YOU FIX IT loop: act → improve
How you fix it

Hold, escalate, block

A check with no authority is a dashboard. These are the three things a breach can actually do.

Act

Stop one agent, not the fleet. A breaching action can be held for review, escalated to a person, or blocked before it completes, and there is a kill switch that halts a single agent while the rest keep running.

Improve

Tune the schema against reality. Every intervention shows which schema line the run breached. A false hold tightens the schema; a real breach fixes the agent, and the next runs prove which it was.

Prove

Every intervention lands in the record. Who held what, when, and why is a lookup, so the answer to "what happened and who stopped it" comes from the record, not from memory in a post-incident meeting.

After a prompt change, an invoicing agent started approving credits above its limit. The schema check held the third credit mid-run and escalated to the owning engineer, who paused that one agent while the rest of the fleet kept working. The fix shipped the same afternoon, and the two held credits were released by a person, not by the agent. Illustrative, but this is what an intervention is for.

§06 / QUESTIONS faq: the common ones
Questions
How do I stop an AI agent that is misbehaving in production?
Define an activity schema for the agent, check every run against it as it happens, and give the check authority to act: hold the action for review, escalate to a person, or block it before it completes. Anything less is a report on what already happened.
Can I stop one AI agent without shutting down the rest?
Yes, if intervention operates per agent rather than per deployment. Prefactor's kill switch halts a single agent's runs while the rest of the fleet keeps working, and records the intervention.
What is an activity schema for an AI agent?
A machine-checkable definition of what the agent's job allows: the actions it may take, the data it may touch, and the limits it must stay inside. It turns the policy that lived in a document into something every live run is evaluated against.
Does checking every run slow my agents down?
A run inside its schema is never interrupted; the check rides along with the telemetry the run already emits. Only an action that breaches the schema is held, and holding it is the point.
Why can't my observability tool do this?
Tracing and observability tools are read-only by design: they record what happened and stay out of the action. Stopping a live run requires a layer that both evaluates the run as it happens and holds authority over the action, which is a different job.

See it in action on a fleet like yours

Book a demo and bring your riskiest agent: define its activity schema, watch a breach get held mid-run, and stop one agent while the rest keep running.

Agent Performance Platform
Unified performance platform for agents, authentication, and risk management
All Systems Operational
3Global Agents
7Instances
5Services
12%Human Intervene
4High Risk
$2,360Monthly Spend
Mission ControlLive agent health with 7-day activity heartbeat
Claims Proc...68
$330/moRed
Claims Proc...65
$160/moRed
Claims Proc...82
$170/moAmber
ChatGPT74
$150/moAmber

See how every agent performs, and make it better

Prefactor helps teams observe, evaluate, and improve their AI agents in production, across every framework and provider.