Stopping an agent that is already running: what actually works when there is no button

An agent went into a loop with real side effects and I discovered there was nothing to press. What I have in place now, in order of how reliably it works.

Things that stop it

• A hard step and token ceiling per run. Not a safety feature so much as a floor under the damage, and the only one that works while you are asleep. Set it lower than feels necessary.
• A spend limit at the provider, with an alert well below it. The alert is the part that matters, because it arrives before the ceiling does.
• Killing the process or the container. Reliable, blunt, and the reason to run agents in something you can destroy without thinking. If the agent runs inside your normal shell, this is a much worse moment.
• Revoking the credential it is using. The most effective interruption available, because it stops the effects rather than the loop. Give every agent its own key so that revoking one does not take everything else down.

Things that do not

• Asking it to stop, which is a message in a queue it may not read.
• A stop button in a wrapper, unless you know it cancels the underlying request rather than the display of it. Several stop the stream and let the run continue.

The structural point: interruption is unreliable and containment is not. Scoped credentials, a throwaway execution environment, and no write access to anything you cannot restore means a runaway run is expensive rather than dangerous. Design for that instead of for a button.

Log what it did, not just what it said. Recovering from a bad run needs the tool calls and their arguments, and most setups keep only the conversation.