# Agent Lifecycle Operations

This guide covers the controls you reach for when an agent needs to be paused, contained, or shut down. For the conceptual lifecycle an agent moves through, see [Agent Lifecycle](/agent-lifecycle/); for creating and managing agents day to day, see [Manage agents](/cli-agents/).

## Check current state

```bash
dvx agent get my-agent     # status, identity, recent activity
dvx status                 # the whole fleet at a glance
```

## Isolate (kill switch)

Cut an agent off **immediately** - the strongest containment short of deletion. Use this if an agent is misbehaving:

```bash
dvx agent isolate my-agent --reason "investigating unexpected network calls"
```

Bring it back when you're satisfied:

```bash
dvx agent restore my-agent
```

## Revoke credentials

Invalidate all of an agent's tokens. It cannot renew once its current short-lived JWT expires (and with token-ID blacklisting, the current JWT is rejected immediately too):

```bash
dvx agent revoke my-agent
```

Revocation doesn't tear down the agent - use it when you want to stop the agent's access but keep the agent record. To bring a revoked agent back online, reprovision it (`dvx agent reprovision my-agent`).

## Decommission

Permanent teardown - revokes tokens, runs deprovisioning hooks to clean up external identities, destroys the compute, and preserves the audit trail:

```bash
dvx agent delete my-agent
```

## Which one do I use?

| You want to… | Use |
|--------------|-----|
| Temporarily stop an agent, then resume it | `dvx agent isolate` / `dvx agent restore` |
| Cut off access but keep the agent record | `dvx agent revoke` |
| Permanently remove the agent and its identities | `dvx agent delete` |

Suspension, revocation, and decommission map directly onto the lifecycle states described in [Agent Lifecycle](/agent-lifecycle/).