The claim
Most agent governance plans assume one thing: revoke the agent’s identity and the agent stops. Two vendor write-ups published three days apart test that assumption from opposite ends.
On 6 November AWS published a test of Okta Cross App Access with Amazon Bedrock AgentCore, including what happens when you revoke an agent (vendor, AWS). On 9 November OpenAI described Control Room, the system it uses to track and stop model workloads across its research infrastructure (OpenAI). We could not load OpenAI’s post from our environment, so every Control Room detail below is OpenAI’s as reported by Forkast and RuntimeWire (independent).
The inputs
| Stop action | Where it acts | Time to take effect | Source |
|---|---|---|---|
| OpenAI Control Room stop | Inference path: engines check each request against the job’s authorisation | Up to 35 seconds from the stop instruction to no further progress, an upper bound OpenAI attributes to an authorisation cache | independent |
| Okta: delete the resource connection | Between the agent and the resource it calls | “took effect immediately” | vendor, AWS |
| Okta: tokens already issued | Held by the agent | Work until they expire, up to 5 minutes | vendor, AWS |
| Okta: deactivate the AI agent | Identity provider, beta AI agent API | Queued for 86 minutes in the test org, with no cancel | vendor, AWS |
OpenAI also requires every research job doing agentic inference to request a job ID at start and to have an approved safety case, and Control Room fails closed: if it is down or disabled, inference requests are denied until it resumes (independent, Forkast).
The result
In OpenAI’s design the enforcement point is the call to the model itself, and the only thing that outlives the stop is the authorisation cache, which sets the 35-second bound. In AWS’s test, the fastest stop was also on the call path: deleting the resource connection. The slowest was the identity action, deactivating the agent.
On these two write-ups the claim fails. Revoking the identity is the slow stop. The fast stop sits where the agent makes its calls, and its speed is set by how long anything already issued stays valid.
Assumptions: each write-up describes its own system accurately, and the timings carry over only to stacks built the same way.
Where it breaks
- You cannot buy Control Room. It is an internal research system (independent, RuntimeWire). It works because OpenAI runs its own inference engines. A firm calling a third-party model API needs a gateway it controls before it can add a per-request check.
- The 35 seconds is OpenAI’s own upper bound. No independent test exists. Forkast describes the clock as starting when Control Room receives a stop instruction; RuntimeWire as starting at the stop decision. The time to notice a problem sits outside both.
- AWS’s figures come from one sandbox. An Okta Integrator Free Plan org, sample code marked non-production, and a beta Okta API (vendor, AWS). A production tenant may behave differently.
- Fail closed has a price. If the stop service goes down, legitimate work stops too, and a check on every request adds latency. That is the strongest case for leaving the stop in the identity layer, and it is a trade-off to decide per agent, not by default.
- Stopping is not undoing. A stop prevents further progress. Anything the agent already wrote, sent, or changed stays done.
Decision: where your stop goes
| Your agents call models and tools through | Put the stop | What to expect |
|---|---|---|
| An API gateway you run | A per-request check keyed by agent or run ID, failing closed for high-risk agents | Bounded by your cache lifetime. Measure it. |
| A vendor-hosted agent platform | The platform’s own stop, plus removing the agent’s connection to each resource | Whatever the vendor delivers. Test it before you rely on it. |
| Long-lived keys in agent code | Rotate the key now, then move the agent behind a gateway | The slowest of the three, set by how fast you can redeploy. |
Five steps this quarter
- Step 1. Map every agent’s call path. For each agent, list how it reaches models and tools, and which credentials it holds. Owner: AI platform lead.
- Step 2. Choose one enforcement point on that path. Give every run an ID it must present on each call, so a stop can name it. Owner: platform engineering.
- Step 3. Decide fail open or fail closed, in writing, per agent. Agents that move money, data, or customer records fail closed. Owner: risk owner with the agent’s business owner.
- Step 4. Set credential lifetimes to the exposure you accept. In AWS’s test, tokens already issued kept working for up to 5 minutes after revocation (vendor, AWS). Owner: identity team.
- Step 5. Measure stop-to-silence in your own stack. Issue a stop to a non-production agent and time the last successful model or tool call. Keep the raw timings and repeat after every platform change. Owner: security operations.
Missing
- OpenAI’s method for the 35-second figure, and how often Control Room has been used to stop a job.
- An independent test of either the 35-second or the 86-minute figure.
- Whether Okta’s beta deactivation queue behaves the same way in a production tenant.
- A Prestanda measurement. We have not run Step 5 ourselves; it is a test design, not a result.
Frequently asked questions
Can we buy OpenAI’s Control Room?
No. As reported by Forkast and RuntimeWire, Control Room is an internal system deployed across OpenAI’s research infrastructure. No product, customer availability, or open-source release has been announced.
Does deactivating an agent in Okta stop it immediately?
Not in AWS’s test. Deactivating the agent sat in Okta’s beta AI agent API queue for 86 minutes in an Okta Integrator Free Plan org, with no way to cancel. Deleting the resource connection took effect immediately, and tokens already issued kept working until they expired, up to 5 minutes.
What does fail closed mean for an agent stop?
If the stop service is unavailable, requests are refused rather than allowed. OpenAI’s Control Room is reported to deny inference requests until it resumes. The cost is that an outage of the stop service also stops legitimate work.
Living page. Last updated 10 Nov 2026. We update this note if OpenAI publishes its measurement method, Okta moves the AI agent API out of beta, or an independent test appears.