Operations
Halt switch
Stop every action at once, and resume.
The halt switch refuses every action on every service until someone resumes. Diagnosis and notes continue, so people still get the evidence.
Autonomy → Halt everything, give a reason, confirm. Resume is on the same page.
Halting takes effect at once and needs no approval. Who halted, when and why is recorded in the audit log.
3AM checks again between approval and execution: a change approved after the halt is not run. The incident is
escalated and the audit log records decision.blocked with the reason. The same applies if the service's autonomy was
lowered, or its action budget was used up, while the approval was pending.
To lower a single service instead, set its autonomy to shadow or off (Autonomy).