raxit agent

raxit agent manages a daemon's kill switch for individual agent principals — list who's governed, kill an agent's ability to get any decision other than deny, inspect its history, and restore it.

Usage

$ raxit agent list --addr localhost:8181
PRINCIPAL                        KILLED  SINCE                  BY               REASON

$ raxit agent kill default-agent --reason "docs fact pack demo" --addr localhost:8181
kill: default-agent: kill

$ raxit agent list --addr localhost:8181
PRINCIPAL                        KILLED  SINCE                  BY               REASON
default-agent                    yes     2026-07-11T22:31:37Z   operator         docs fact pack demo

$ raxit agent inspect default-agent --addr localhost:8181
{
  "agent": {
    "principal": "default-agent",
    "killed": true,
    "kill_entry": {
      "principal": "default-agent",
      "killed_at": "2026-07-11T22:31:37.1238Z",
      "by": "operator",
      "reason": "docs fact pack demo"
    }
  },
  "history": [
    {
      "principal": "default-agent",
      "action": "kill",
      "by": "operator",
      "reason": "docs fact pack demo",
      "at": "2026-07-11T22:31:37.1238Z"
    }
  ]
}

$ raxit agent unkill default-agent --addr localhost:8181
unkill: default-agent: unkill

$ raxit agent list --addr localhost:8181
PRINCIPAL                        KILLED  SINCE                  BY               REASON
default-agent                    no      -                      -                -

Subcommands

list — every principal the daemon has a kill record for, killed or not.
kill <id> --reason <text> — every subsequent call from this principal is denied, regardless of policy, until unkilled.
unkill <id> — restore normal policy evaluation for the principal.
inspect <id> — current kill state plus the full kill/unkill history as JSON.

Flags

--addr <host:port> — daemon to manage (defaults to localhost:8181).
--reason <text> (kill) — required justification, written into the audit trail.
--identity-token <token> (or RAXIT_IDENTITY_TOKEN) — operator identity sent as X-Raxit-Identity, required when the daemon runs with --verify-key.

Gotchas

Kill is a daemon-side, in-memory override — it takes effect immediately for every subsequent call, independent of what security.yaml currently allows, and is scoped to that one daemon process (it doesn't persist across a daemon restart).
agent list returns an empty table until at least one principal has been killed or unkilled — it does not enumerate every agent id the daemon has ever seen a call from, only ones with a kill record.

raxit agent

Usage

Subcommands

Flags

Gotchas

On this page