Definition
Whether a named person can halt a harmful process, measured as time to halt: the minutes from the decision to halt until the process has stopped. A system is stoppable when that time is measured, has a target, and does not depend on someone breaking a rule or escalating to get there. It needs automatic halts that fire on signs of harm, a target for time to halt that is measured, and named operators with clear authority to halt without permission from above.
Halt paths are rehearsed, observable, and usable under stress, and do not sit behind exceptional permissions. A kill switch or circuit breaker is a mechanism that carries out a halt; stoppability is the property that the halt can be used. Holding one case while a person looks is a pause, and holding one account or asset is a freeze; neither makes a system stoppable.
What is stoppability? — the explainer, with a worked example
Tests that show it is in place
- Each high-risk workflow has documented halt controls, owners, and on-call coverage.
- Time-to-halt targets are met during drills or real incidents, with outcomes logged.
Hypothetical example
- A dispatch platform can halt automated routing citywide within minutes when false-priority signals spike, while preserving manual override for emergency coordinators.
References
- Governance taxonomy · Resource
- Diagnostics · Resource