Mirantis Agent Platform GA: the AI agent kill switch checklist

Someone just shipped an AI agent kill switch as a headline feature. That tells you where agents are in production. On November 10 at KubeCon North America, Mirantis announced general availability of Mirantis Agent Platform, a self-hosted system for running AI agents on Kubernetes. The selling points aren't smarter agents. They're sandboxes, spending caps, audit logs, a person approving fixes, and one button that cuts every agent off the network.

What actually happened

From the press release and Mirantis's product page:

• Sandboxed agents, deny-by-default network. Each agent runs in its own sandbox. Outbound traffic is blocked unless a policy allows it.
• Keys the agent never holds. Credentials for clusters, clouds and APIs are injected at the network boundary, so a compromised agent can't read them.
• Spend caps at organization, project and agent level, plus a full audit trail of every action.
• The kill switch. One click refuses new connections and model calls for every agent in the org. Sandboxes keep running and nothing is deleted, so you can investigate and restore.
• Human-approved fixes. Mirantis's built-in Prism agent diagnoses production issues and proposes fixes, but a person approves before it applies them.
• Bring your own model. Inference goes through AWS Bedrock, Microsoft Foundry, OpenAI or OpenRouter on your own keys. Install is one Helm chart on any conformant Kubernetes cluster.

It's not open source. There's a 30-day evaluation and no public pricing; you request a license through sales.

Mirantis cites Salt Security data: 49.8% of organizations surveyed confirmed or suspected an unintended or unauthorized agent action in the past year, and only 17.5% can automatically stop a misbehaving agent.

Why it matters for your business

You're probably not running Kubernetes. Doesn't matter. This feature list is the best checklist we've seen for any agent that touches your store, inbox or books. Ask your vendor, or whoever built your automation:

1. Can I stop every agent at once, without deleting anything?
2. Does the agent hold my API keys, or are they kept out of its reach?
3. Is there a hard spend cap per agent, not just an invoice at month's end?
4. Can it call any website, or only the ones I approved?
5. What needs my approval before it acts: refunds, emails to customers, price changes?

If the answer to #1 is "log in and revoke tokens one by one," you don't have a kill switch.

Sources: Mirantis via Business Wire, Mirantis Agent Platform product page.