Step the automation down to manual, freeze merges for bot pull requests, close or label the open ones, record the pause, and restart only after a named person confirms the cause is understood. The whole sequence should take minutes and be written down before you ever need it.
When to pause
Pause on any of these signals:
- A fix pull request merged and production behavior changed.
- Several bot pull requests failed checks in a pattern you cannot explain.
- The bot's credentials may be exposed, or an unexpected push or branch appeared.
- An active incident where adding changes makes diagnosis harder.
- A change freeze starts.
When unsure, pause. Resuming is cheap. A second bad merge is not.
The runbook
1. Step down the mode. Move every category to manual, or switch the feature off, using the control your tool provides. Make this possible for anyone on call without a second approver.
2. Freeze merges. Stopping new proposals does not stop merges of ones already open. Use your repository rules to block merging for the bot's pull requests, for example by adding a required check that fails while a freeze flag is set, or by turning a ruleset to disabled and back as policy allows. Test the method in advance, since mistakes here are common.
3. Handle open pull requests. Label them with a freeze tag. Do not delete them, since they are evidence. Close any that touch the affected area, noting why.
4. If credentials are in doubt, rotate. Revoke the bot's token, then issue a new one only after you have reviewed recent activity.
5. Record the pause. Time, who paused, the trigger, what was affected, and the link to the incident.
Restarting
Do not restart on a timer. Restart when:
- The cause is identified, or the bot is ruled out.
- A named owner agrees.
- You restart in manual mode, then move one category at a time back to what it was.
Keep a short written check, for example: credentials verified, last ten merges reviewed, checks still required, volume cap still set.
What to prepare in advance
| Item | Detail |
|---|---|
| Pause authority | Who may pause, with no approval needed |
| Method | The exact setting or command, tested quarterly |
| Merge freeze mechanism | A switch that blocks bot merges |
| Contact list | Owners of the bot, the repositories, and incident command |
| Log location | Where the pause record goes |
Rehearse it as a drill. Pick a quiet afternoon, pause, confirm no new bot pull requests appear and none can merge, then restart. A drill that takes an hour teaches more than a document nobody has tried.
The difference between pause and rollback
A pause stops new change. A rollback removes change already made. You will often need both. For the second, see how to revert a merged fix PR. For wider design thinking, the post on kill switch, feature flag and rollback compares the three.
Safeguard offers autonomous remediation with fix PRs, off by default with every category on Manual. If yours is on, this runbook is how you get back to that state quickly.
Quick check
Is turning off the bot enough to stop changes?
No. Pull requests already open can still be merged, so freeze merges as well.
Should we delete the open bot pull requests?
No. Close or label them and keep them, since they are part of the evidence for the incident review.
Last reviewed: 19 October 2026.
