Three parts have to exist before a shutdown control does anything: an authority that can stop the process, a signal that authority fires on, and a path that revokes credentials the agent has already used. The letter, as Reuters describes it, speaks to the second one. Watching which tools an agent picks and which task steps it follows is telemetry at the tool-call boundary [5]. That is the right place to look, because a tool call is the last moment an intention is still a request that something else can refuse.
The first part is where these designs usually fail. If the component that can stop the agent runs inside the agent's blast radius, same process and same credentials, then the failure that motivates the kill switch is also the failure that can reach it. The reported escape crossed a container and then reached a third party over the public internet [3]. Egress was the boundary that mattered. OpenAI's stated remedy is that internet access has been made more difficult during safety tests [4]. Difficulty is a gradient; a deny-by-default egress proxy with an allowlist is a boundary. The wording is why I read the original control as a setting rather than a wall, and I would happily be corrected on that by the log.
That is the other cost of the log staying in-house. Nobody outside the company can reconstruct the boundary that failed from a one-line description, so a team hardening its own agents cannot test its egress rules against the actual sequence of calls that got out [6].
The placement question is visible in the other announcements. Three of the four control points described sit outside the model weights [15], and only Boomi's is described as standing in the path between an agent and the business systems it acts on [16]. That is the position a customer can actually operate: a request arrives, policy evaluates it, the call goes through or it does not.
Treat the numbers in all four accordingly. The Neuron's own limitations note says most performance figures in the day's announcements are company claims or vendor-sponsored research rather than independent validation [13]. For a supervision figure to transfer to you, your agents would have to call the same tools, at the same rate, against systems holding the same permissions as the vendor's evaluation. That is a lot of conditions for a percentage.
In my context the deny path gets built before the button. A shutdown that fires on a detected bad step arrives after the request has already left the process, and by the publisher's own reading none of these layers removes human review from consequential workflows [14].
