Stop an agent on its platform
MeetLoyd's kill switch refuses every call an agent sends through the MeetLoyd gateway. An agent built on another platform can also run there on its own: a Copilot Studio or Foundry agent never calls the gateway at all. To stop such an agent, MeetLoyd switches it off on its own platform, with the platform's own control.
It is one control for every platform: open the agent in MeetLoyd, find Stop on its platform, and the card tells you what will be stopped, what stopping does there, and which right it needs.
How it works
- The organisation owner clicks Stop on its platform and gives a reason.
- MeetLoyd asks the platform to switch the agent off, with the credential you set up for that platform.
- The platform confirms; MeetLoyd records who stopped it, when and why, in the audit trail.
- Restart on its platform switches it back on the same way.
Only the owner can stop or restart. Nothing happens unless the platform accepts the change: if the right is missing, the card says which one to grant.
Per platform
| Platform | What is stopped | Effect | Right to grant | Where it is set |
|---|---|---|---|---|
| Microsoft Foundry | The Foundry agent | It refuses every request until it is enabled again. | An Azure role on the Foundry account with the data actions Microsoft.CognitiveServices/accounts/AIServices/agents/state/disable/action and …/state/enable/action. Nothing else is needed. | Tools → Secrets → Microsoft service account, with that role assigned to the app on the Foundry account |
| Microsoft Entra agent identity (Copilot Studio and Foundry agents found in Entra) | The agent identity | It can no longer obtain tokens, so every Microsoft resource refuses it. | Microsoft Graph application permission AgentIdentity.EnableDisable.All | Tools → Secrets → Microsoft service account |
| Microsoft Entra app registration used as an agent | The service principal | It can no longer obtain tokens. | Microsoft Graph application permission Application.ReadWrite.All | Tools → Secrets → Microsoft service account |
| Microsoft Copilot Studio (found in Dataverse) | The agent, quarantined | It stops answering in every channel; makers can still open and test it. | A user who is Global administrator, AI administrator or Power Platform administrator connects Copilot Studio admin (Power Platform API scope CopilotStudio.AdminActions.Invoke). Classic chatbots cannot be quarantined. | Connections → Copilot Studio admin |
| Salesforce Agentforce | The active agent version, deactivated | The agent is unavailable to its users until it is activated again; restarting reactivates the same version. | The Salesforce user of the Agentforce source must be allowed to activate and deactivate agents. | Discovery → Salesforce Agentforce |
A Foundry agent found in Entra is stopped by Foundry itself, which stops the agent and not only its tokens.
Where there is no switch
Some platforms offer no way to switch an agent off short of deleting it. MeetLoyd does not delete agents to stop them.
| Platform | What the platform offers | What you can do |
|---|---|---|
| AWS Bedrock AgentCore and classic Bedrock Agents | Stop one session, or delete | Restrict the IAM role the agent runs as, or route its calls through the gateway |
| Google Vertex AI Agent Engine, Conversational Agents | Change or delete | Disable the service account the agent runs as, or route its calls through the gateway |
Good to know
- Restarting outside MeetLoyd is seen. If someone re-enables a stopped Entra identity directly in Entra, the next discovery sweep sees it and opens a security case.
- The right can be narrow. Each switch needs only the right in the table, separate from the read-only rights discovery uses. You can grant it for the platforms where you want a stop, and nowhere else.
- A Copilot Studio agent needs one discovery sweep first. Quarantine addresses an agent by its environment; MeetLoyd records the environment at the sweep after the Copilot Studio source is set up.
- The stop and the gateway work together. For an agent that also calls the gateway, halting it in MeetLoyd refuses those calls at once; stopping it on its platform covers everything else it does there.