Agent Lifecycle Operations

This guide covers the controls you reach for when an agent needs to be paused, contained, or shut down. For the conceptual lifecycle an agent moves through, see Agent Lifecycle; for creating and managing agents day to day, see Manage agents.

Check current state

dvx agent get my-agent     # status, identity, recent activity
dvx status                 # the whole fleet at a glance

Isolate (kill switch)

Cut an agent off immediately - the strongest containment short of deletion. Use this if an agent is misbehaving:

dvx agent isolate my-agent --reason "investigating unexpected network calls"

Bring it back when you’re satisfied:

dvx agent restore my-agent

Revoke credentials

Invalidate all of an agent’s tokens. It cannot renew once its current short-lived JWT expires (and with token-ID blacklisting, the current JWT is rejected immediately too):

dvx agent revoke my-agent

Revocation doesn’t tear down the agent - use it when you want to stop the agent’s access but keep the agent record. To bring a revoked agent back online, reprovision it (dvx agent reprovision my-agent).

Decommission

Permanent teardown - revokes tokens, runs deprovisioning hooks to clean up external identities, destroys the compute, and preserves the audit trail:

dvx agent delete my-agent

Which one do I use?

Suspension, revocation, and decommission map directly onto the lifecycle states described in Agent Lifecycle.