Deployment circuit-breaker
A pre-authorized clamp-down that fires when a measured signal crosses a threshold — the control Robodebt never had.
What it changes
Who can pull it
What it looks like institutionally
Most documented failures were eventually stopped — by courts, commissions, or journalists, years in. A circuit-breaker moves that stopping power inside the institution and ahead of the crisis: a monitored signal (error rate, override rate, complaint volume), a written threshold, and a pre-authorized response — pause, degrade to manual, restrict scope — that a named actor can trigger without convening anyone.
The design work is all in the "pre": pre-chosen signals, pre-agreed thresholds, pre-granted authority. A breaker negotiated during the emergency is a committee.
Test it like a fire drill. A breaker that has never fired in an exercise will not fire in an incident.
Addresses: Multi-year unchecked failure · No internal stopping authority. Test a version of this lever in the PAN Lab.