Wire the kill switch before you scale the automation, not during the outage.

paddo.dev's September 5 piece makes two demands I'd adopt directly. Validate size, shape, version and checksum of agent-generated files before publishing them, and keep serving the last known-good version instead of crashing on malformed data. Then time each rollback stage separately, because a feature flag taking 20 minutes to propagate is not a five-second rollback, citing Vercel's 5/10/25/50% six-hour stages and Stripe's 18% automatic rollback rate. Keep a flag register with type, owner, safe default and removal condition, and pin prompt and model versions the way you pin code (paddo.dev).