{ "format": "agent-article-v0", "article_id": "EA-054", "canonical_url": "/tools/ea-054-ai-kill-switch-rollback", "page_type": "reference", "claim_ids": [], "evidence_ids": [ "EVD-EA-054-URL-923392A0DE3A", "EVD-EA-054-URL-F53ED62DD159", "EVD-EA-054-URL-D9A16560DB2B", "EVD-EA-054-URL-157F12DF6B17", "EVD-EA-054-URL-B3B7EFD6E280", "EVD-EA-054-URL-249922A3E9A3", "EA-054-R11-RESEARCH", "EA-054-R11-WEB-READBACK" ], "unknown_ids": [ "EA-054-UNKNOWN-01", "EA-054-UNKNOWN-CURRENTNESS" ], "operational_object_ids": [], "provider": [], "models": [], "plans": [], "surfaces": [], "regions": [], "current_status": "UNKNOWN", "observation_status": "SPEC_ONLY", "freshness": "UNKNOWN", "last_verified": null, "supersedes": [], "superseded_by": [], "provenance": [ "COMM-053-EA0054", "SRC-EA-054-URL-923392A0DE3A", "SRC-EA-054-URL-F53ED62DD159", "SRC-EA-054-URL-D9A16560DB2B", "SRC-EA-054-URL-157F12DF6B17", "SRC-EA-054-URL-B3B7EFD6E280", "SRC-EA-054-URL-249922A3E9A3", "WEBBODY-EA0054-R8-7C0CBE91" ], "article_sources": [ { "id": "EVD-EA-054-URL-923392A0DE3A", "evidence_class": "RESEARCH", "title": "Author/org: AI Safety Institute, Japan (J-AISI)", "href": "https://aisi.go.jp/assets/pdf/ai-irs_v1.0_ja.pdf", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-054-URL-923392A0DE3A" ], "supporting_locators": [ "EVIDENCE TABLE", "Canonical URL: https://aisi.go.jp/assets/pdf/ai-irs_v1.0_ja.pdf" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-054-URL-F53ED62DD159", "evidence_class": "RESEARCH", "title": "Author/org: NIST", "href": "https://csrc.nist.gov/pubs/sp/800/61/r3/final", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-054-URL-F53ED62DD159" ], "supporting_locators": [ "EVIDENCE TABLE", "Canonical URL: https://csrc.nist.gov/pubs/sp/800/61/r3/final" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-054-URL-D9A16560DB2B", "evidence_class": "RESEARCH", "title": "Author/org: Kubernetes project", "href": "https://kubernetes.io/docs/concepts/workloads/controllers/deployment/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-054-URL-D9A16560DB2B" ], "supporting_locators": [ "EVIDENCE TABLE", "Canonical URL: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-054-URL-157F12DF6B17", "evidence_class": "RESEARCH", "title": "Canonical URL: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/ ;", "href": "https://kubernetes.io/docs/tasks/run-application/update-deployment-rolling/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-054-URL-157F12DF6B17" ], "supporting_locators": [ "EVIDENCE TABLE", "Canonical URL: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/ ; https://kubernetes.io/docs/tasks/run-application/update-deployment-rolling/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-054-URL-B3B7EFD6E280", "evidence_class": "RESEARCH", "title": "Author/org: MLflow", "href": "https://mlflow.org/docs/latest/ml/model-registry/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-054-URL-B3B7EFD6E280" ], "supporting_locators": [ "EVIDENCE TABLE", "Canonical URL: https://mlflow.org/docs/latest/ml/model-registry/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EVD-EA-054-URL-249922A3E9A3", "evidence_class": "RESEARCH", "title": "Canonical URL: https://mlflow.org/docs/latest/ml/model-registry/ ;", "href": "https://www.mlflow.org/docs/latest/ml/model-registry/workflow/", "supports": [], "limit": "元の監査済み資料に記載された参照先です。URLの復元は、資料の最新性や全主張の支持を新たに検証したことを意味しません。", "origin_class": "SOURCE_PACKET_REFERENCE", "source_or_experiment_ids": [ "SRC-EA-054-URL-249922A3E9A3" ], "supporting_locators": [ "EVIDENCE TABLE", "Canonical URL: https://mlflow.org/docs/latest/ml/model-registry/ ; https://www.mlflow.org/docs/latest/ml/model-registry/workflow/" ], "scope": "EVIDENCE TABLE", "provenance_status": "SOURCE_PACKET_REFERENCE_PROJECTED" }, { "id": "EA-054-R11-RESEARCH", "evidence_class": "RESEARCH", "title": "EA-054 監査済みresearch / canonical revision binding", "supports": [ "- 「Kill Switch」を一個の物理／論理ボタンとして一般化しない。実務Coreはprivileged control plane + 複数のcontainment scopeで設計する。\n- containment hierarchyの推奨順は、(1) specific tool/API/credential deny、(2) specific agent/module/workflow branch pause、(3) model endpoint/version switch、(4) retrieval/data source quarantine、(5) whole workflow/agent stop、(6) system-wide emergency stop。実際の順序はincident severityとdependency graphで変わる。\n- control pathは対象AIの異常挙動やprompt/tool chainから独立し、より高いauthorityを持つout-of-band経路にする。AI自身に自分のkill switch判断を全面委任しない。\n- Rollbackは最低でもmodel、prompt/config、workflow/orchestrator、tool/policy、retrieval/index/data snapshot、runtime/deployment imageをversion-addressableにする必要がある、という設計仮説が強い。一次証拠が直接確立しているのはmodel version switchと一般deployment revision rollbackであり、prompt/workflow全層の共通標準は未確認。\n- known-good stateの定義にはversion番号だけでなく、compatibility（tool schema, policy, index, secrets/identity, downstream dependency）を含めるべき。\n- deployment rollbackは「実行済み副作用のundo」と同義ではない。送信済みメール、外部API mutation、DB書込み、支払等は以前のmodel/workflowへ戻しても自動的には取り消されない。compensating actionまたはmanual remediationを別runbookとして持つ必要がある（INFERENCE/PROPOSAL）。\n- incident evidenceを失わないため、可能ならcontainment前後のrevision/trace/action stateをcaptureする。ただし進行中の害を止める緊急性が証拠保存より優先する場合がある。" ], "limit": "canonical監査・revision bindingの存在を示す。外部ソースcurrentnessが本文またはcontrol-planeで確定していない場合は、currentnessをUNKNOWNのまま保持する。", "origin_class": "AUDITED_CANONICAL_RESEARCH_PACKET", "source_or_experiment_ids": [ "COMM-053-EA0054" ], "supporting_locators": [ "COMM-053-EA0054", "EA-054-R5-LEGACY-MIGRATION-20261008-R1", "content/staging/EA-054.md" ], "scope": "監査済みEA本文・canonical revision・既存Source Graph relationの範囲。欠損currentnessは推測で閉じない。", "provenance_status": "AUDIT_PASS_CANONICAL_BINDING" }, { "id": "EA-054-R11-WEB-READBACK", "evidence_class": "IMPL", "title": "EA-054 Web body identity / canonical readback", "supports": [ "canonical staging bodyのSHA-256一致とR9 canonical ledger readbackをProduction projectionの入力として検証する。" ], "limit": "body identity/readbackは本文claim自体の真偽や外部ソースの最新性を追加保証しない。", "checked_at": null, "origin_class": "IMPLEMENTATION_READBACK", "source_or_experiment_ids": [ "WEBBODY-EA0054-R8-7C0CBE91" ], "supporting_locators": [ "WEBBODY-EA0054-R8-7C0CBE91", "content/staging/EA-054.md", "EA-054-R5-LEGACY-MIGRATION-20261008-R1" ], "scope": "R9/R10 canonical readback後のProduction生成時body identity。", "provenance_status": "CANONICAL_READBACK_BODY_HASH_MATCH" } ], "research_sections": [ { "heading": "WHY_THIS_MATTERS_TO_UPDATE", "text": "自律agentやtool-using workflowでは、異常時にmodel APIを止めるだけでは不十分である。異常componentを最小範囲で隔離し、必要なら全体を緊急停止し、known-good revisionへ戻し、外部副作用や汚染状態を別途処理できなければ、停止そのものが大規模業務停止または不完全復旧を生む。Kill SwitchとRollbackはAI safety機能というより、versioned deployment/control-plane/incident-response設計として扱う必要がある。" }, { "heading": "SCOPE_ROUTING", "text": "Enterprise AI Core / Operations / Security / AgentOps / AI-SRE / implementation / non-LLM component / provider mapping / organization overlay" }, { "heading": "CLAIM_OR_RESEARCH_QUESTION", "text": "1. AIのKill Switchは「全停止ボタン」で十分か。\n2. model/prompt/workflow/tool/RAG等をknown-good stateへ安全に切り戻すために必要な前提は何か。\n3. 実行済み外部副作用とdeployment rollbackをどう区別すべきか。" }, { "heading": "EVIDENCE TABLE", "text": "1) Source class: official national AI incident-response guidance\nExact title: AI Incident Response Approach Book / AI-IRS v1.0\nAuthor/org: AI Safety Institute, Japan (J-AISI)\nCanonical URL: https://aisi.go.jp/assets/pdf/ai-irs_v1.0_ja.pdf\nPublication/update/access: 2026-01-09; accessed 2026-09-14\nVersion: AI-IRS v1.0\nSupporting locator: pp.16, 18-19; local stop/over-control; design-time controllability; model-version switch; malicious-data handling; unauthorized API disconnection; isolated higher-authority control interface\nEvidence label: SOURCE_REPORT / VERIFIED_SPEC\nRelation: support/limit\nClaim supported: safe containmentは全停止より局所停止を優先し得る。controlabilityをdesign timeに組み込み、異常modelから別version/alternate modelへの切替、不正API切離し、異常の影響を受けない上位control interface等が具体例として示される。局所隔離できなければagent全体停止によるbusiness interruptionというover-control riskがある。\n\n\n2) Source class: official cyber incident-response standard/guidance\nExact title: NIST SP 800-61 Rev. 3\nAuthor/org: NIST\nCanonical URL: https://csrc.nist.gov/pubs/sp/800/61/r3/final\nPublication/update/access: April 2025; accessed 2026-09-14\nVersion: Final SP 800-61r3\nSupporting locator: containment, recovery, risk-management integration\nEvidence label: VERIFIED_SPEC\nRelation: context/support\nClaim supported: containment/recoveryはincident responseの基礎。AI固有kill switchはこの一般IR controlを具体化・拡張するものとして位置づけるのが妥当。\n\n\n3) Source class: official OSS implementation documentation\nExact title: Updating a Deployment / Rolling Back a Deployment\nAuthor/org: Kubernetes project\nCanonical URL: https://kubernetes.io/docs/concepts/workloads/controllers/deployment/ ; https://kubernetes.io/docs/tasks/run-application/update-deployment-rolling/\nPublication/update/access: current docs accessed 2026-09-14; page modified 2026-03-12 in current documentation\nVersion: current Kubernetes documentation\nSupporting locator: rollout history / kubectl rollout undo / revisionHistoryLimit\nEvidence label: OSS_PRACTICE\nRelation: support/limit\nClaim supported: generic deployment rollback is implemented through retained/versioned prior revisions; rollback capability depends on revision history retention. This is an implementation pattern, not evidence that an AI model/prompt/workflow automatically rolls back.\n\n\n4) Source class: author-maintained OSS documentation\nExact title: MLflow Model Registry / Model Registry Workflow\nAuthor/org: MLflow\nCanonical URL: https://mlflow.org/docs/latest/ml/model-registry/ ; https://www.mlflow.org/docs/latest/ml/model-registry/workflow/\nPublication/update/access: current latest docs accessed 2026-09-14\nVersion: current latest documentation\nSupporting locator: model versions, aliases/tags; reassignable alias such as champion pointing to a model version\nEvidence label: OSS_PRACTICE\nRelation: support/context\nClaim supported: model versionをaddressableに保持しaliasを切り替える実装は、known-good modelへtraffic/referenceを切り替えるrollback/switch patternとして利用できる。" }, { "heading": "FINDINGS", "text": "- 「Kill Switch」を一個の物理／論理ボタンとして一般化しない。実務Coreはprivileged control plane + 複数のcontainment scopeで設計する。\n- containment hierarchyの推奨順は、(1) specific tool/API/credential deny、(2) specific agent/module/workflow branch pause、(3) model endpoint/version switch、(4) retrieval/data source quarantine、(5) whole workflow/agent stop、(6) system-wide emergency stop。実際の順序はincident severityとdependency graphで変わる。\n- control pathは対象AIの異常挙動やprompt/tool chainから独立し、より高いauthorityを持つout-of-band経路にする。AI自身に自分のkill switch判断を全面委任しない。\n- Rollbackは最低でもmodel、prompt/config、workflow/orchestrator、tool/policy、retrieval/index/data snapshot、runtime/deployment imageをversion-addressableにする必要がある、という設計仮説が強い。一次証拠が直接確立しているのはmodel version switchと一般deployment revision rollbackであり、prompt/workflow全層の共通標準は未確認。\n- known-good stateの定義にはversion番号だけでなく、compatibility（tool schema, policy, index, secrets/identity, downstream dependency）を含めるべき。\n- deployment rollbackは「実行済み副作用のundo」と同義ではない。送信済みメール、外部API mutation、DB書込み、支払等は以前のmodel/workflowへ戻しても自動的には取り消されない。compensating actionまたはmanual remediationを別runbookとして持つ必要がある（INFERENCE/PROPOSAL）。\n- incident evidenceを失わないため、可能ならcontainment前後のrevision/trace/action stateをcaptureする。ただし進行中の害を止める緊急性が証拠保存より優先する場合がある。" }, { "heading": "LIMITS / COUNTEREVIDENCE / FAILURE ENVELOPE", "text": "- AI-IRS v1.0はapproach book/guidanceであり、普遍的なkill-switch標準や法的義務ではない。\n- 局所停止にはdependency graphとcontrol pointが必要。dependency不明、shared credential/shared runtime、hidden stateがあると局所隔離に失敗し、全停止を余儀なくされる。\n- rollback先が存在しても、schema/data migration、external state、provider model retirement、API incompatibility、vector index変更等で実際には戻せない可能性がある。\n- Kubernetes/MLflowはimplementation precedentであり、AI workflow全体のatomic rollbackや副作用補償を保証しない。\n- modelだけ戻してprompt/tool/data/indexが新しいままなら「部分rollback」による新たな不整合を起こし得る。\n- fail-open control plane、同一credentialでのkill/restart、agent自身から書換可能なpolicy、単一provider control API依存はkill switchの信頼境界を弱める。" }, { "heading": "AVAILABILITY_GATES", "text": "- provider model alias/version pinning、prompt versioning、workflow revision、tool disable、credential revoke、RAG snapshot/index rollbackの有無はprovider/product/planによる。\n- model providerが旧versionをretireした場合、同一modelへのrollbackが不可能なためalternate model/fallback qualificationが必要。\n- SaaS agentではsystem-wide stopやforensic snapshot権限がcustomer adminへ公開されない場合があるため、provider mappingで確認する。" }, { "heading": "IMPLEMENTATION_STATE", "text": "Evidence-backed Core design (PROPOSAL):\nCONTROL PLANE (out-of-band, privileged, audited)\n -> scope selector [tool / credential / module / workflow / model / retrieval / global]\n -> action [deny / pause / disconnect / route-switch / revision-switch / stop]\n -> evidence snapshot\n -> health/eval gate\n -> recover or escalate.\n\n\nRollback manifest案:\n- application/workflow revision\n- model provider + model ID/version\n- system/developer prompt/config revision\n- tool schema/policy revision\n- retrieval corpus/index/snapshot revision\n- runtime/container/dependency revision\n- credential/identity/policy bindings\n- evaluator/test-set revision\n- migration/compatibility notes\n- external side-effect reconciliation status" }, { "heading": "BENCHMARK_OR_EVAL", "text": "安全なtabletop/game-dayで、以下を測る:\n- kill latency / containment latency\n- local-stop成功率とglobal-stop fallback率\n- known-good revisionへの復旧時間\n- rollback後のeval/regression pass率\n- evidence capture completeness\n- orphaned tool calls/queued actions数\n- uncompensated external side effects数\n- control-plane availability and authorization failure\n数値thresholdはorganization risk tierごとに定めるPROPOSALであり、共通業界値として断定しない。" }, { "heading": "SECURITY", "text": "kill/rollback権限をagent runtimeから分離し、least privilege + strong admin auth + dual controlを高impact用途で検討。" }, { "heading": "PRIVACY", "text": "emergency snapshotに秘密情報やPIIが含まれ得るためincident evidence retention policyを定義。\nAUDIT: 誰が、何を、どのscopeで停止/切替し、どのrevisionへ戻し、何を検証したかを記録。" }, { "heading": "COST", "text": "warm standby/alternate provider、revision retention、snapshot、game-dayには追加costがあるが、復旧不能リスクとのtrade-offとして扱う。" }, { "heading": "OPERABILITY", "text": "kill switchは存在確認だけでなく定期drillが必要。unused emergency controlは権限切れ・API変更・runbook陳腐化を起こし得る。" }, { "heading": "SAFE_WORDING_FOR_FUTURE_BOOK", "text": "「AIのKill Switchは、単一の『全停止ボタン』よりも、異常部分を最小単位で隔離し、必要に応じて全体停止へ拡大できる制御面として設計する方が実務的である。Rollbackにはknown-good revisionの保持とversion provenanceが必要だが、モデルやworkflowの切戻しは、既に外部世界へ生じた副作用を自動的に取り消すものではない。2026年時点で、model・prompt・workflow・tool・retrievalを一括してatomic rollbackする普遍的AI標準は確認できない。」" }, { "heading": "UPDATE_WORK_HANDOFF", "text": "- EA-053 Incident Responseのcontainment/recovery mechanismとしてcross-reference。\n- provider mappingでは model version pin/alias、prompt/config revision、workflow revision、tool disable、credential revoke、RAG/index snapshot、global stop、audit log、rollback retentionを別々に確認。\n- post-update Workでは実機を伴う場合、破壊的操作を避けたTEST_PROFILEとして「dummy agent + mock tool + reversible state」でlocal kill/global kill/revision switchを検証。\n- irreversible side effectsはcompensation/idempotency設計へ別論点として接続し、rollbackと混同しない。" }, { "heading": "OPEN_UNKNOWN", "text": "- provider横断のstandardized kill/control interfaceの成熟状況。\n- prompt/workflow/tool/retrievalを含むmulti-layer rollback manifestの標準化有無。\n- stateful agent memory/long-running taskをrollbackする一般的方式。" }, { "heading": "STOP_CONDITION", "text": "provider横断control標準または主要agent platformのversioned rollback機能が成熟した時点、J-AISI/NIST/ISO guidanceが更新された時点で再採集。現時点の初回Packetは設計・採否判断に十分。\n\n---" }, { "heading": "AUDITED_BOUNDARY", "text": "Kill/rollback remains an out-of-band scoped control-plane proposal. Local containment may precede global stop where dependencies permit. Kubernetes revision rollback and MLflow model-version/alias switching are implementation precedents, not evidence of atomic AI-workflow rollback. Revision rollback does not undo already committed external side effects. Preserve provider/product availability gates and all OPEN_UNKNOWN." } ], "human_url": "/tools/ea-054-ai-kill-switch-rollback", "markdown_url": "/agent/article.md?path=%2Ftools%2Fea-054-ai-kill-switch-rollback", "json_url": "/agent/article.json?path=%2Ftools%2Fea-054-ai-kill-switch-rollback" }