Section 19 · Safety, Deliverability & Governance

19.6Kill switch

Built in the POC

What DMA asked for · Decision Book p.35

DMA can switch off autonomous actions immediately if something goes wrong.

Why it matters to DMA: The basic safety net for any system that acts on its own anywhere.

In our words, from DMA's Product Decision Book v3, page 35.

One click in the header, "Pause outreach", stops everything that goes out: every queued send and write is held, and the website chat falls back to a lead form.
Finer switches sit on the Controls screen: per channel (email, website chat), per capability (AI replies, outbound email, CRM writes, e-sign and payments, the model itself) and per record type in Nutshell.
Switches are checked in code at the moment of acting, not when something was approved, so a pause also stops work that was already approved.
Some switches trip themselves: too many bounces pauses outbound email, the AI budget limit pauses the model, and a drift between the CRM copy and Nutshell pauses writes to that record type until a person looks.

It plays on its own while it's on screen; hover or use the controls to pause or step through.

Step 1 of 3

Paused

Someone clicks "Pause outreach", or a breaker trips.

The same six stages on every page. Nothing reaches Nutshell except through the write gate.

1A person or a breaker
Source
The pause.
2Sync
Copies Nutshell changes into the bridge database
Reconciliation drift can trip a record-type switch.
3Bridge database
A copy of the CRM data, plus what the AI works out
Each switch, who tripped it, why and when.
4AI
Claude models, only through DMA's own gateway
Paused too: the model switch stops every AI call.
5Write gate
The only way back into Nutshell: checked, approved when needed, sent once
Holds every write while CRM writes are paused.
6Nutshell
The system of record
Nothing is written while paused.

Drawn from the POC's database catalogue: structure only, no data.

PK primary keyFK reference the database enforces (solid line)ID reference kept by id (dashed line)

Table	What it holds	Columns
ctrl.kill_switches	Every switch: its scope, whether it is tripped, by whom, why, and its automatic breaker.	9

Synthetic demo data: every name, business and number is made up.

1 / 4

What you see

1.Pause everything

The global switch, the same as the header's "Pause outreach".

localhost:13301/controls

What happens in the system

Bridge databasectrl.kill_switches
The global switch; every action checks it at the moment of acting.

The switches in the POC and what each one stops.

Switch	What it stops	Trips itself when
Pause all outreach	Every queued send and write; the chat falls back to a lead form	AI spend passes the budget
Outbound email	The send governor releases no email; approved items stay held	Bounce rate over 5% in 24 hours
Website chat autonomy	The widget shows the lead form instead of AI replies	—
CRM writes	Approved changes stay in the write gate, unsent	—
Accounts / deals / people	Writes to that record type in Nutshell	The CRM copy drifts from Nutshell

localhost:13301/controls

Govern → Controls: the kill switches and the sending limits.

Dashboard · Controls, the kill switches. Captured from the running POC on September 25, 2026; synthetic data.

Opens the exact screen in the running POC, in a new tab.

Open	Where	What to try
Controls	DMA AI dashboard	Every switch, one click each.

Built in the POC

Built in the POC. This capability runs in the POC today, on synthetic data, end to end.