Who it protects · Commercial
When the board asks who can stop it, you need a name and a time.
Agent fleets that widen their own scope, copilots wired into finance, code and customer data, vendors who promise a shutdown they have never rehearsed. SEARIN gives a company a scoped, two-key cut that lands in seconds and leaves evidence an auditor will accept.
< 8s
Estate-wide severance from second key to contained
6
Lifeforce channels metered per workload
4 / yr
Witnessed drills in the standard programme
100%
Cuts recorded in the signed custody ledger
What goes wrong here
The failures this deployment is built against.
Every control below exists because one of these has already happened somewhere, to someone with the same estate as yours.
Scope creep nobody approved
An agent granted read access quietly acquires write, then spawns helpers with the same credentials. Substrate metering flags the expansion — compute, tokens, egress, new identities — days before it becomes an incident.
The vendor kill switch that has never been pulled
Model providers describe shutdown capability in a safety framework. None of it is wired to your estate, and you cannot test it. SEARIN sits on your side of the boundary, where you can rehearse it quarterly.
Copilots inside finance and source control
Coding and finance assistants hold the credentials that move money and ship code. Scoped severance revokes exactly that identity and its tokens without taking payroll, ERP or the helpdesk down with it.
Copies you did not know existed
Weights, prompts and fine-tunes leak into personal accounts, staging clusters and third-party sandboxes. The replica hunter tracks derivative copies so a cut covers the lineage, not just the production endpoint.
How it works here
The severance chain, stage by stage.
The same seven stages run everywhere. What changes is who holds the keys, what is in scope and how fast the cut has to land.
Every autonomous workload in the estate is enumerated
Cloud accounts, on-prem clusters, SaaS copilots, RPA, service identities and CI runners are inventoried and grouped into severance scopes — per agent, per team, per fleet, per site, whole estate.
Six channels are wired per scope
Power and compute quota, network egress, identity and secrets, storage and memory, replicas, and the physical interlock at each rack. Nothing is in scope until it is wired and tested.
Substrate metering against a declared baseline
Each workload runs against a declared envelope. Compute growth, new outbound destinations, identity creation, replica spawning and memory expansion all raise graded alerts in the control room.
Two named people, two keys
Arming requires Key A and Key B held by different people, mapped to your existing on-call rota. The scope, the reason and both identities are written to the ledger before anything is severed.
Scoped severance in a fixed order
Identity and tokens first, then network egress, then compute and storage holds, then replicas, with the rack interlock as the physical backstop. Everything outside the declared scope keeps running.
Channel-by-channel confirmation
The control room shows each channel as live, severed or out of scope, and holds the cut open until every in-scope channel confirms severed. Unconfirmed channels escalate to the interlock.
Staged return with re-credentialling
Restoration is stepwise and reversible: storage read-only first, then compute, then fresh credentials, then egress. New credentials are issued — the severed ones are never reused.
Scope
What the switch touches — and what it never touches.
Scope is surveyed, written down and physically wired before the first rehearsal. Nothing outside the covered list can be cut.
In scope — severable
- Agent fleets, copilots and autonomous workflows
- Model endpoints, inference clusters and GPU capacity
- Service identities, API keys, OAuth grants and machine secrets
- Vector stores, long-term memory and retrieval corpora
- Outbound network egress per workload and per namespace
- Derivative replicas, fine-tunes and exported weights
Excluded — physically barred
- Payroll, ERP and finance systems of record
- Building life safety, fire suppression and access egress
- Telephony, incident paging and emergency communications
- Identity infrastructure for human staff
- Backup and restore infrastructure itself
- Anything outside the signed severance scope
Authority
Who is allowed to pull it.
A cut is never automatic and never anonymous. Authority is held by named people in named roles.
Two-person rule
No single employee can sever production. Key A and Key B are held by different roles — typically the on-call security lead and an engineering director — and both are recorded on every cut.
Scoped delegation
Team-level scopes can be delegated to team leads, so a single misbehaving agent is stopped in seconds without escalating to an estate-wide decision.
Break-glass with review
A declared emergency allows single-key severance of a named scope, which automatically opens a post-incident review with the full ledger attached.
Deployment
From first survey to first rehearsed cut.
What actually happens, in order, once you engage SEARIN.
Phase 01
Lifeforce survey
Two to four weeks. SEARIN engineers inventory autonomous workloads across cloud, on-prem and SaaS, then propose severance scopes and exclusions for your sign-off.
Phase 02
Instrumentation and interlocks
Channel controls are deployed per scope and Sentinel Mk.II interlocks are installed at each rack or comms room by certified electricians, with life-safety circuits enumerated and barred.
Phase 03
Shadow drills
Cuts are exercised in shadow mode against production telemetry with no real severance, until timings and confirmations are reliable.
Phase 04
Witnessed live cut
A real scoped cut is executed under observation, timed end to end, verified and restored — producing the first evidence pack for your risk committee.
Evidence you keep
Every cut leaves a record someone else can check.
- A signed custody ledger entry for every arm, cut, verification and restore
- Quarterly drill reports with end-to-end timings per channel
- A scope register showing exactly what is severable and what is barred
- An evidence pack formatted for auditors, insurers and regulators
Recommended plan
Sentinel Business
Custom — priced per site after evaluation
Preorder free, no payment. Typically includes the Lifeforce survey, six-channel instrumentation, one Mk.II rack interlock per site, two-key authority, control-room access, quarterly drills and the signed evidence pack. Additional interlocks and live cut exercises are priced separately.
Get a price
Request a quote for this deployment.
Scoped to your estate, with survey dates and what is barred from severance written down before anything is installed.