Mechanical answer: dashboard → pause or delete. Delete stops the local runtime and removes the agent from Telegram simultaneously.
The mechanism that matters is that revoking on MOI is a state change, not a message. Authority lives in your context as the participant—not in the agent’s configuration. Withdraw that authority, and the agent does not need to receive a notification, cooperate, or even remain reachable. The authority is simply no longer there for the agent to act on or for a verifier to accept.
Why conventional kill switches fail at machine speed: you notice the problem, revoke the token at the issuer, and the issuer marks it invalid. But every downstream system learns about that change on its own schedule—through an introspection call, a cache TTL, a scheduled sync, or another propagation mechanism. Until that happens, the agent can continue acting at machine speed.
Structural, not tunable: exposure within the window = actions per second × window length. The exposure scales with agent throughput, not simply with time. Increase agent speed, and exposure grows linearly; shorten the token lifetime, and you trade that exposure for increased re-issuance traffic—recreating the coordination cost that tokens were meant to eliminate. There is no setting on that dial that is inherently safe at machine speed.
On MOI, revoking is advancing the context. An Authority Grant cannot be lost or stolen because it is never transmitted in the first place—the agent never held a copy. A verifier checks the grant at the point of action, and once the grant is revoked, that check returns a different result immediately and everywhere, including for agents spawned after the change
Observable version: deploy an agent through the MOI Agent Launchpad, and it appears in Telegram with a local runtime process running on your machine. Delete the agent, and the runtime stops while the agent simultaneously disappears from Telegram. There is no waiting for a sync interval or downstream propagation—the change is reflected immediately across both surfaces.
Compromised agents are the critical case. Tool-channel injection succeeds against ReAct-style agents 56–70% of the time, with roughly 60% attack success on StrongREJECT across six frontier models. Injection, therefore, is not an edge case. But an attack succeeding at the model layer does not have to succeed at the authority layer. An injected agent can be persuaded to attempt anything; it cannot be persuaded into authority it was never granted, nor can it retain authority you have withdrawn, because it never held a transmittable copy in the first place.
Limitations: revocation is instant at the source, but end-to-end effectiveness still depends on verifiers actually checking the updated state. Stopping is not the same as undoing—revocation prevents future action but cannot reverse what has already happened. Scope limits the blast radius; it does not guarantee good judgment or prevent undesirable behavior within the granted authority.
DevNet stage. Evaluate accordingly.