Immediate Actions (Halt, Hold, Notify Deployers) When break-glass is activated, three immediate actions follow. Halt: the system stops processing new inference requests. Hold: pending decisions that have not yet been communicated to affected persons are held and not released until the situation is resolved. Notify deployers: all active deployers are informed that the system has been suspended, with guidance on fallback procedures. The halt action is automated through the stop button, kill switch, or feature flag. The hold action requires that the system’s deployment architecture supports holding pending outputs, which should be designed into the system during Phase 3. Deployer notification uses the pre-established communication channels, with a pre-drafted suspension notification template. The three actions occur in parallel, not sequentially. Waiting to notify deployers until the halt is confirmed introduces unnecessary delay in deployer environments where affected persons may still be receiving the system’s outputs through cached responses. Key outputs

• Three parallel immediate actions (halt, hold, notify)
• Hold capability designed into system architecture
• Pre-drafted suspension notification template
• Parallel execution to minimise harm window