In-Application Stop Button The primary break-glass mechanism is a prominent, clearly labelled control in the operator’s review interface. When activated, it triggers an API call to the inference service that suspends request processing, drains in-flight requests (completing them, not dropping them, to avoid data loss), and returns a “service suspended” response to any subsequent requests. The stop button must be visually prominent (not buried in a menu), immediately responsive (activation to suspension within seconds), and available at all times (not disabled by any system state). The button’s activation is logged with the identity of the person who activated it, the timestamp, and the case context. The in-application stop button provides the fastest intervention pathway for operators who are actively using the system and observe harmful behaviour. Key outputs

• Prominent in-application stop control
• Immediate inference suspension with request draining
• Logged activation with identity and timestamp
• Module 7 AISDP documentation