The safest autonomous systems know when to stop before a human notices a problem. A kill switch should include measurable stop conditions, not only a manual emergency control.
Stop an experiment when it exceeds its budget, violates a permission rule, loses access to required evidence, fails to produce a defined market signal within its test window, or produces inconsistent outputs that cannot be audited.
Prefer staged publishing, scoped credentials, capped budgets and operations that can be rolled back. The more irreversible an action is, the more likely it should require explicit approval.