Section 43
Emergency Controls
The automation interface exposes:
Disable Automation
Session states include:
ACTIVE / PAUSED / REVOKED / EXPIRED / DEGRADED
Revocation invalidates all future automated execution.
Global Emergency Pause
Production global emergency pause is controlled by a Safe 3-of-5 multisig.
The emergency pause has no timelock, allowing immediate containment of critical incidents.
Unpausing requires the same authorized multisig and documented incident review.
The multisig cannot access, move or custody user funds. Its authority is limited to protocol emergency controls.
All emergency actions are fail-closed and recorded.