A Platform Manager (with their passcode) or the tenant's PGM pauses one agent or executor, a set of them, or the whole tenant: every request is refused and every enforcer refuses. A maintenance window lets people operate an executor locally while every AI command stays refused; it closes by itself. No agent or API credential can pause or resume. The platform owner pauses only for a security emergency.
Every refusal, missed heartbeat, fingerprint change, clock skew and break-glass action an enforcer reports is CRITICAL and in the vault.
A permit names one executor. An action no executor performs gets no permit. Registering an executor, a domain setting, adding a keyholder and accepting a new fingerprint are proposals: they take effect when a Platform Manager of the tenant, not the proposer, approves them on the Changes page.
Shadow mode returns the verdict as an observation that no enforcer executes. Use * for the whole tenant.
Before every execution the enforcer asks TNL whether a pause applies. If it cannot get a verified answer, a CRITICAL action (the default, and always for an approved action) is refused; a ROUTINE action runs on the last state TNL sent, only if that state is no older than the limit below. Changing either is the tenant's decision: a Platform Manager with their passcode, or the PGM with their credential re-entered (the proof fields in the Pause card). ROUTINE, or a longer limit, is a proposal: it takes effect when another Platform Manager approves it on the Changes page. CRITICAL, or a shorter limit, applies at once. Recorded in the vault.
During a TNL outage, two keyholders together may sign a time-limited break-glass grant. Every action under it is journaled and reported.
This tenant's own keys. Its permits, pause-check answers and heartbeat answers are signed with its permit key, which its enforcers pin; its agent credentials with its credential key. No other tenant's key is accepted for it. Rotating a key is a proposal another Platform Manager approves on the Changes page; the old key stays accepted for the grace window, then is retired.