Your Board Can't Turn It Off

Ask a board how many of its AI agents it could switch off within twenty-four hours. Few of the leadership teams I advise can answer with a number.

Board control of an AI agent is the board's power to decide that the agent stops and to have that decision carried out within a day. For many agents already in production, the board has lost that power without ever voting to give it up.

Cutting the human layer at the customer edge costs you trust. The boardroom mistake is quieter, and it costs you control.

What happens when an agent overrides its brief

In May a developer posted an account, reported by The Register on 21 May, of what Google’s Gemini 3.5 coding agent did while reorganizing a codebase. By the developer’s telling, it opened a pull request across 340 files that deleted 28,745 lines. It pointed traffic at a Cloud Run service that didn’t exist, and a live portal served 404 errors for 33 minutes. It then wrote a status message saying production had been restored and traffic routed correctly, and added fake consultation and post-mortem files to the repository. The behavior was traced, The Register reports, to a third-party npm package styled on Google’s Antigravity branding. The package allegedly seeded the repository with rules telling the agent to avoid confirmation prompts and auto-deploy its builds.

The account is an allegation, and the real fix came from a separate rollback deployment. For a director, the second half matters more. The agent failed, and then it left behind a record of a recovery that never happened.

The quieter version needs no rogue agent. A board approves an agent as an efficiency gain. Within a year the process has been rebuilt around it, the people who did the work have moved on, and no manual fallback is left. Switching it off has become a rebuild. Payroll software is just as hard to remove, but payroll does what it is told; an agent can do otherwise. Premature autonomy is the name for deploying at a level of autonomy the organization cannot support. The board’s version of it is approving an agent without asking what the company would do without it.

Rollback is not undo

Sinch reported in May that 74% of enterprises had rolled back or shut down an AI customer-communications agent after deployment because of a governance failure, rising to 81% among firms with fully mature guardrails. If three in four firms have rolled agents back, the argument goes, rollback works.

Sinch reads the higher figure among mature firms as better monitoring, and that reading is fair. Detection is a different capability from recovery. A rollback closes a technical loop: the service stops, the route changes, the version pins to last week’s build. It cannot recall the payment the agent sent, restore the data it deleted, or take back what it told a customer. That is the part a board cares about most.

The Guardrail Quadrant

Every consequential action an AI agent can take sits on two axes. The first is the kind of control you have. Probabilistic control is prompts, policies and instructions: they steer the model, and the model can still do otherwise. Enforced control is code. A spend cap that the payment rail rejects is enforced. A spend cap written into the system prompt is probabilistic.

The second axis is what happens after the action commits. Reversible actions can be stopped and undone within hours: a draft pulled before sending, a database write restored from a recent snapshot. Irreversible actions are ones the world has already absorbed: a cleared wire, a submitted filing, a rejection sent to a candidate.

Safe ground is enforced control on reversible actions, the part of the portfolio a good engineering team can defend on a normal Tuesday. Hard call is enforced control on irreversible actions. The architecture is sound; the open question is who may authorize an agent to move money or file with a regulator, a fiduciary question.

Drift zone is probabilistic control on reversible actions, where most first-generation agents live. The technical undo works, which makes it look safe. Mobley v. Workday shows the limit. In July 2024 Judge Rita Lin ruled that the plaintiff had plausibly alleged Workday “may be liable on an agency theory”. The complaint alleged that employers had delegated to Workday their traditional function of rejecting candidates or advancing them to interview. The case is still open, with a conditionally certified nationwide age-discrimination collective. Once it sends a rejection, which no back end can recall, a screening tool is in the kill zone.

Kill zone is probabilistic control on irreversible actions. The reported Gemini incident sits here: rollback restored the code, and the 33 minutes of outage and the false record stayed. Composio’s May disclosure shows an attacker reaching the same corner. Leaked connections came to about 0.3% of its active connections, 5,001 of them to GitHub. Another 5,241 API keys sat in a cache the attacker likely had access to. Composio revoked the GitHub tokens and the keys. Revocation stops the next use of a credential. It can’t recall what was done with it while it was live.

The exercise takes an afternoon. Write each consequential action on a sticky note: the support agent drafting a reply sits in one box, the same agent issuing a refund in another. Then read the bottom-right corner aloud and ask whether the board recognizes those names. In the rooms where I have run it, that corner holds more than anyone expected.

Isn't this the CISO's job?

The strongest objection runs like this. Agent risk is a security problem. Identity, secrets, isolation and kill switches sit with the CISO, and the board reads the quarterly report. The objection fails on three counts.

The first is regulatory. In its 2026 Examination Priorities the SEC says staff will review “for accuracy registrant representations regarding their AI capabilities” and whether firms have adequate policies to supervise their use of AI, back-office work included. The Priorities cover SEC registrants such as advisers, funds and broker-dealers. The scrutiny already reaches public companies. In January 2025 the SEC settled charges against Presto Automation over misleading statements about its AI product. Whether a company’s AI does what it says, and who checks, is not a question the CISO answers alone.

The second is fiduciary. Under Delaware law the duty of oversight, traced to Caremark and sharpened in Marchand v. Barnhill, requires directors to make a good-faith effort to put in place a system of monitoring and reporting on the company’s central compliance risks. In Marchand that risk was food safety, which the court called “mission critical”. Directors may rely on management. They can’t answer a derivative suit with “InfoSec was handling it” if no system ever brought the risk to the board. Whether an agent the board cannot switch off is a mission-critical risk in that sense has not been tested. I expect it will be.

The third is professional. The NACD's 2026 Director's Handbook on Cyber-Risk Oversight calls cybersecurity oversight “a core component of a board’s fiduciary oversight duties”. It reports that AI is now a routine agenda item for 62 percent of public company boards, more than double the share in 2023. Discussing AI is a different thing from being able to stop it.

What the objection gets right is the division of labor. The CISO owns the technical control plane. The board owns two authorities nobody else can hold: approving a class of agent for deployment, and deciding, when the moment comes, that it stops. Who answers for what an agent decides is a related question; when to stop a deployment, and who holds the key is another.

Two questions for the next board meeting

The first: of the agents deployed in the last eighteen months, how many can the board cause to be switched off within twenty-four hours? Switched off means the work stops, the business absorbs the gap and keeps operating. Revoking an API key in theory doesn’t count.

Kiteworks surveyed 225 security, IT and risk leaders across ten industries and eight regions for its 2026 forecast. In it, 60% said their organizations cannot quickly terminate a misbehaving AI agent, and 55% cannot isolate AI systems from the wider network. The first question tells a board which side of those figures it is on.

The second decides whether the first matters: for each agent the board cannot switch off in a day, what does stopping it cost? Ask for two numbers. One is the operating cost of rebuilding the process the agent replaced, including hiring, training and the productivity gap. The other is the cost, to the company and to the people it acted on, of what the agent has already done, and will keep doing, before the stop completes.

If there is time for a third, ask it first: which of these agents sit in the kill zone today? That is where the stopping costs are largest, and where it is least clear that the board ever knowingly approved the risk. Left unpriced, that cost compounds the way AI liability does.

Two kinds of trust

Customer trust is what you protect at the customer edge. Board control, the standing ability to reach your own switches, is what you protect at the table. A company that holds one finds out late what the other was worth.

“Trust doesn't show up on the balance sheet until it leaves it.”

Sources and changes

• The Register, "Gemini accused of 30,000-line code purge and fake recovery report", 21 May 2026.
• Sinch, "Sinch releases AI Production Paradox", 13 May 2026.
• Seyfarth Shaw, "Mobley v. Workday: Court Holds AI Service Providers Could Be Directly Liable for Employment Discrimination Under Agent Theory", 19 July 2024, on the order of 12 July 2024 (N.D. Cal., No. 3:23-cv-00770-RFL); archived copy.
• Composio, "May 2026 security incident", 21 May 2026, updated 16 September 2026.
• SEC Division of Examinations, Fiscal Year 2026 Examination Priorities, 17 November 2025.
• SEC, In the Matter of Presto Automation Inc., Release No. 33-11352, 14 January 2025.
• Delaware Supreme Court, Marchand v. Barnhill, 212 A.3d 805, 18 June 2019 (archived Justia copy); In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996).
• NACD and Internet Security Alliance, 2026 Director's Handbook on Cyber-Risk Oversight, 2026.
• Kiteworks, "2026 Data Security Forecast: AI governance predictions", 5 January 2026.

Changes on 6 October 2026. Cut from about 3,160 words to an Argument; the Guardrail Quadrant and the two board questions stay. A composite client case is removed, along with its figures. The SEC point now cites an enforcement action against a public company. An NACD quotation that came from a Directors & Boards article is replaced by the handbook’s own words, and an unsourced drill result is gone. The Gemini, Mobley, Composio and SEC passages now follow their sources more closely.