Explain how to design a kill switch that product can operate without an engineer.

Codepass is Cinder Hollow's AI pre-screener for building permit applications. Here is what a scoped, non-engineer kill switch would have done the week its auto-reject rule quietly went wrong, and what it actually took to stop.

How to answer this, stage by stage

Nobody is grading whether you know the phrase "kill switch." They're grading whether you can name who holds it and what it defaults to.

Let's learn

Codepass is an AI tool Cinder Hollow's Department of Buildings uses to pre-screen permit applications against code before a human reviewer ever opens the file.

Before Codepass, a reviewer read every application front to back, about ninety minutes each, with a three-week backlog across the department.

Now Codepass reads an application in seconds and either clears it forward or auto-rejects it with a boilerplate code citation, cutting the average time-to-decision for cleared applications from three weeks to two days.

Four steps, and the last one is missing entirely, not just slow.

Here's the turn: the extra speed was never the problem. The real cost showed up once a routine model update, meant to cut false approvals, started over-triggering rejects on a paperwork format solo contractors use more than large firms, and nobody had a fast way to know that or fix it without waiting on an engineer's calendar.

At its worst, an entire trade of small, independent contractors quietly loses a week or more of paid work every time this happens, with no appeal button and no one at the city even aware yet.

One of these two people can act in seconds. The other one is still waiting to find out why.

What I would leave alone: auto-approve for clearly compliant applications doesn't need this same scrutiny. A wrongly approved application still gets a human sign-off before a permit is actually issued, so that mistake is already caught downstream.

The lesson: a kill switch isn't a nice-to-have you bolt on once something breaks. It's the thing that decides how many people get hurt between the moment something breaks and the moment somebody official first notices.

Now here is the same thing as a story

The short version above is what you'd say defending this design to Cinder Hollow's city council. Read this one for how the six weeks actually went.

Anika Fessler has run permitting operations for six years, and she can tell which code citations her reviewers actually argue over from the ones that are clean and obvious, usually before she's finished reading the file.

Codepass launched and cleared the easy seventy percent of applications in seconds, freeing her human reviewers to focus on the genuinely complicated filings. The backlog fell from three weeks to two days for most applicants within a month.

Month one, Anika spot-checked a sample of auto-rejects every day, reading the actual application behind each one. By month three she only checked weekly, since every reject she'd seen cited a real code issue. By month five she stopped checking auto-rejects at all, trusting the citation shown to the applicant on its face.

Rosalind Mbeki, a solo electrical contractor, filed a routine panel-upgrade permit and got auto-rejected, citing a code section that, reading it herself, didn't even seem to apply to her scope of work. A colleague mentioned at the supply house that the exact same citation had hit his filing that week too.

Six months between launch and the moment anyone official knew the rate had climbed.

The portal offered Rosalind only a "resubmit" link, restarting the same automated review from zero. She resubmitted twice, was rejected twice more, and lost eleven days of a scheduled job waiting on a permit that should have taken two.

It wasn't really about Rosalind's eleven days. An entire class of routine electrical filings had been silently misclassified, and there was no faster way for the city, or for any contractor living through it, to make that stop than waiting on an engineer's calendar.

With the scoped kill switch built, the same day Anika hears the remark, she opens her dashboard, flips auto-reject off for that permit type specifically, and every filing routes to a human reviewer within the hour. Rosalind's original filing, resubmitted that afternoon, clears human review in ninety minutes.

This is what Anika's toggle actually contains. None of it needs an engineer to reach.

The old design asked the auto-reject rule to be right forever. The new one just gave Anika a fast way to admit it wasn't, this once.

I set the false-positive bar in early testing at "low enough," because that's the number engineering could show me at launch. It took a contractor's own eleven-day wait, and a colleague's remark at a supply house, to see that "low enough" and "zero people it happens to" were never the same promise.

GUARD, mapped onto the switchNot a lecture on being careful. GUARD is what tells you who holds the lever and who doesn't.

The recap, one line per letter: groups is Anika and Rosalind, unequal is solo contractors bearing nearly five times the false-reject rate, ability to contest is the missing appeal step, reduce is the scoped, logged toggle, and detect is watching the rate daily instead of waiting for a complaint.

The scoped switch is the middle branch of a rule Anika can apply without waiting for anyone else's judgment call.

All four of these fit inside one dashboard permission. None of them requires a code change.

And if you want to be sure it really works, try it somewhere elseSame five letters, an AI resume screener instead of a permit portal. A different lever, the same missing appeal.

Bramwell Staffing runs ScreenFirst, an AI tool that ranks incoming resumes for open roles before a recruiter ever opens one. Tomas Enright applied for a logistics coordinator role and was auto-screened out before any recruiter saw his application. Mapped onto GUARD: groups is Julissa Ferro, the recruiting ops manager who would hold the kill switch, and Tomas, the candidate with no lever at all; unequal is that candidates changing careers or re-entering the workforce get filtered out at a noticeably higher rate than candidates with a conventional resume format, since the model was mostly trained on conventional ones.

The reduce step is structurally the same idea aimed at a different harm: a scoped toggle Julissa holds directly turns off auto-screen-out for a specific role or a specific resume pattern, routing everyone in that group to a human recruiter's queue by default, no deploy, a logged name and timestamp on every flip. The detect step Bramwell's team built was a weekly check of auto-reject rate by resume format and career-gap length, not just an overall pass rate, since an average pass rate can look perfectly healthy while one identifiable group is being filtered out far more often.

The same four parts, aimed at a hiring flow instead of a permit flow.

Swap the trigger and it still runs.
Speed: an interviewer caps you at sixty seconds. Say "a scoped toggle, logged, defaulting to a human, held by whoever runs the flow day to day," and stop.
Cost: there's no budget to build a full dashboard this quarter. Say so honestly, and ship the single highest-risk toggle first, the one flow where a wrong auto-decision costs the most.
The model gets better, for real: if Codepass's accuracy genuinely improves overall, that's still not a reason to remove the scoped switch, the harm from one bad week doesn't shrink just because most weeks are fine.

Where people run it wrong.
They build one global kill switch that only engineering can flip, so it sits unused during exactly the incidents it exists for.
They default a flipped-off flow to silent auto-approve instead of a human queue, trading one invisible failure for another.
They wait for an external complaint instead of watching the rate against its own baseline, when the people harmed worst are the ones least likely to complain.

How to use it live. When someone asks you to design a kill switch for product to run without an engineer, ask yourself one question before naming a single button: who does this actually default to the moment it's flipped? If the honest answer is "nothing," you haven't designed a kill switch, you've designed a light switch with no bulb behind it.

Flashcards (tap any card to flip it)

Check yourself Score: 0 / 0