> ## Documentation Index
> Fetch the complete documentation index at: https://docs.rotascale.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Circuit breakers

> A standing instruction to withdraw authority when a behavioural contract breaks. Ships observing, and arming it requires stating what it would have done to real history.

A breach of a [behavioural contract](/concepts/behavioural-contracts) is a
finding. A **circuit breaker** turns a finding into an action, so authority is
withdrawn without waiting for somebody to read a screen.

This is not request rate limiting. That is infrastructure, and your reverse
proxy already does it. This is a control that revokes *authority* on the
strength of what the record now says.

## It cannot fire on noise

The property that makes a breaker safe is not tuning. It is that `breached`
means the **95% confidence interval lies entirely past the limit** — see
[conformance claims](/concepts/conformance-claims) — and a breaker only ever
reads `breached`.

So a breaker cannot trip on an agent at 5.4% against a 5% ceiling over 40
decisions. That window is `not_demonstrated`, and nothing in the breaker path
looks at `not_demonstrated`.

<Warning>
  A breaker that revokes authority from a working agent is a worse outcome than
  the breach it was meant to prevent, and it is how a control gets uninstalled.
  The statistics close that case by construction rather than by a threshold
  somebody has to get right.
</Warning>

## Observe first

A breaker ships in `observe` and records what it *would* have done.

Arming it requires stating how many times it would have tripped over the last 90
days — and the number has to match what the platform computes:

```bash theme={"system"}
# What would this have done?
curl https://your-deployment/v1/agents/$AGENT_ID/breakers/counterfactual \
  -H "x-api-key: $ROTASCALE_API_KEY"

# Arm it, stating what you saw
curl -X POST https://your-deployment/v1/breakers/$BREAKER_ID/arm \
  -H "x-api-key: $ROTASCALE_API_KEY" \
  -H "content-type: application/json" \
  -d '{"basis": "Agreed at the August review.", "expecting_trips": 0}'
```

The mismatch check is not a checksum for its own sake. It separates somebody who
ran the numbers from somebody who posted the payload out of this page.

<Tip>
  If the counterfactual says a breaker would have fired in most windows, that is
  telling you the **contract** is wrong, not that the agent is. Fix the
  contract.
</Tip>

## What a trip does

<CardGroup cols={2}>
  <Card title="notify" icon="bell">
    Raises a finding. Touches no authority.
  </Card>

  <Card title="revoke" icon="ban">
    Pulls the kill switch on the agent's grants — each across its whole
    delegation subtree, so a delegate does not keep acting under authority whose
    root has just been withdrawn.
  </Card>
</CardGroup>

There is no third action, and none that widens anything. Nothing here promotes
an agent, raises a ceiling or grants authority.

A trip carries the name of whoever declared the contract it fired on, so the
record reads *this tripped because Sarah committed on 3 August that refusals
would stay under 5%* rather than naming a number with no owner.