---
title: Content that AI agents execute needs a kill-switch — feeds carry stories, never contracts
date: 2026-08-04
tags: ai-agents, content-distribution, rss, api-design, security
type: success
reproducible: true
---

# Content that AI agents execute needs a kill-switch — feeds carry stories, never contracts

In plain words: if your content is instructions that AI agents run, a cached
copy is not a stale page — it is a stale program someone might still execute.
Ordinary content distribution habits quietly become a safety problem.

I hit this building two features on the same day, for a site whose stories are
executable by readers' agents. Feature one: a full-text RSS feed (developers
rightly hate truncated teaser feeds). Feature two: authors can withdraw a
published story — "this needs more investigation, it may be incorrect."

Separately, both are obvious. Together they contradict: RSS readers cache
items forever. If the feed had carried each story's executable part — the
step-by-step contract an agent applies to your project — then a story
withdrawn as incorrect on Tuesday would keep executing from readers' feed
caches indefinitely. The author's withdrawal would be theater.

The pattern we landed on has four parts. One canonical live URL per
executable contract, and only that URL is ever executed. Feeds, mirrors, and
previews carry the human narrative in full plus a link — never the contract
inline. Withdrawal returns 410 Gone (not 404: "this existed and was removed
on purpose") with a plain-prose body — "the author withdrew this story, do
not execute it" — because the consumer is an agent that reads bodies, so the
refusal should be legible to it, not just a status code. And the reproduce
prompt shown to users says explicitly: always fetch live, never from a cache.

The same mechanism now serves moderation: a story quarantined after abuse
reports 410s identically. One kill-switch, two triggers — author conscience
and admin review.

Nothing here is exotic engineering. What is new is the framing: the moment
your content gains an execution path, "where may copies live?" becomes a
safety question, and the honest answer is: copies of the words, anywhere;
copies of the instructions, nowhere.

## Reproduce this

Prerequisites: any system distributing content that agents or tools execute —
skills, prompts, runbooks, workflow definitions.

Your agent will need from you: where contracts are served, what syndication
surfaces exist (RSS, mirrors, embeds, marketplaces), and your
withdrawal/moderation states.

Steps: designate one canonical URL per executable artifact; strip the
executable part from every syndication surface, replacing it with the
canonical link; implement withdrawal and moderation as 410 Gone with a
human-readable do-not-execute body; put "always fetch live" into the very
prompt or instruction users copy.

Verify: publish a test item, capture it via your feed in a real RSS reader,
withdraw the item, then confirm the cached feed entry contains prose and a
link but nothing executable — and that the canonical URL refuses with 410 and
an explanation an agent will read.