# n8n Runaway Workflow Kill Switch Checklist

**Brand:** OperatorForge AI  
**Asset type:** Free lead magnet + Pro Pack bonus  
**Audience:** n8n builders, automation consultants, small-business operators running self-hosted or client n8n workflows  
**Pain addressed:** One bad loop, oversized batch, stuck execution, or noisy workflow can take down an entire n8n instance — and the owner may not know how to stop it safely from outside the UI.

## Promise

Use this checklist before shipping an n8n workflow that can loop, batch, fan out, call external APIs, or touch production records. It gives you a practical kill-switch pattern, blast-radius limits, owner escalation copy, and handoff tests so one broken workflow does not become a four-hour outage.

## 10-minute quick pass

1. **Name the runaway path.** Identify every loop, Split in Batches node, schedule trigger, webhook retry, queue, and AI/tool-calling branch that can repeat or fan out.
2. **Set a hard execution budget.** Define max items, max loop count, max runtime, max API calls, and max cost per execution.
3. **Add a circuit-breaker flag.** Store a `workflow_enabled` or `kill_switch` value in a simple control source the owner can edit without opening the workflow editor.
4. **Check the flag early and often.** Put the kill-switch check before expensive calls, before risky writes, and inside long loops.
5. **Use idempotency on writes.** Every CRM update, email, invoice, order, or Slack/Gmail send needs a dedupe key.
6. **Throttle fan-out.** Use batch size, wait/backoff, concurrency limits, and queue separation so one workflow cannot starve the instance.
7. **Route exceptions to a dead-letter list.** Failed or stopped items should be saved with enough context to resume manually.
8. **Create an owner alert only when action is needed.** The alert must say: what stopped, what is safe, what needs review, and how to re-enable.
9. **Document the outside-the-UI stop path.** Include how to disable the schedule/webhook, stop Docker/systemd/queue workers if applicable, or pause the integration upstream.
10. **Run the outage drill.** Trigger a test runaway with a tiny fixture and prove the kill switch stops it before damage.

## Kill-switch control pattern

Use the simplest control plane that fits the client:

| Control source | Good for | Owner action | Notes |
|---|---|---|---|
| Google Sheet / Airtable row | Non-technical owners | Change `enabled` from `true` to `false` | Easiest handoff; slower but visible |
| Static JSON file / environment variable | Self-hosted technical teams | Edit config and redeploy/restart | Best when infra owner is available |
| Database settings table | Production apps | Toggle workflow setting | Good audit trail; needs access controls |
| Upstream trigger pause | Webhooks, forms, email inboxes | Disable form/webhook/rule temporarily | Useful when n8n UI is unavailable |

Minimum fields:

```text
workflow_key
workflow_enabled
max_items_per_execution
max_runtime_seconds
max_external_writes
alert_owner
last_reviewed_at
notes
```

## Circuit-breaker pseudocode

```text
Trigger
  -> Load control row for workflow_key
  -> If workflow_enabled != true: log "paused" and stop
  -> If current execution exceeds max_runtime_seconds: dead-letter remaining items and alert owner
  -> For each batch:
       -> Re-check control row
       -> If disabled: save resume cursor and stop
       -> Process item with idempotency key
       -> Increment write/call counters
       -> If counter exceeds budget: alert owner and stop
  -> Save success evidence
```

## Runaway risk scoring

Score each workflow before delivery:

| Risk factor | 0 points | 1 point | 2 points |
|---|---|---|---|
| Trigger | Manual only | Scheduled | Webhook/email + retry source |
| Looping | None | Small fixed batch | Dynamic loop/fan-out |
| External writes | None | One safe system | CRM/email/payment/order writes |
| API cost | Free/internal | Low paid usage | LLM/image/search/paid APIs |
| Stop path | Owner can pause instantly | Technical stop path exists | No tested stop path |

**Decision rule:**
- 0–3: normal checklist.
- 4–6: kill-switch required before delivery.
- 7–10: add circuit breaker, dead-letter list, and owner outage drill before production.

## Outside-the-UI stop runbook

Fill this in for every client handoff:

```text
Workflow name:
Workflow URL:
Primary owner:
If workflow loops or overloads n8n:
1. Pause upstream trigger:
2. Toggle kill switch:
3. Stop worker/container/service if UI is frozen:
4. Save execution IDs / logs:
5. Notify affected users/customers:
6. Resume only after duplicate/write review:
```

## Owner alert template

Subject: n8n automation paused: {{workflow_name}}

Body:

```text
The automation paused itself because it hit a safety limit:

Workflow: {{workflow_name}}
Execution: {{execution_id}}
Limit hit: {{limit_name}}
Last safe step: {{last_safe_step}}
Items processed: {{processed_count}}
Items saved for review: {{dead_letter_count}}
Customer-visible impact: {{yes_no_and_summary}}

What I need from you:
1. Review the saved items here: {{dead_letter_link}}
2. Confirm whether duplicates or customer messages need cleanup.
3. Re-enable by changing {{kill_switch_location}} to true after review.
```

## Delivery acceptance tests

Run these before a workflow is called production-ready:

1. **Loop test:** a fixture that would process more than the allowed item count stops at the budget.
2. **Disable test:** owner flips the control value to false and the next run exits cleanly.
3. **Mid-batch test:** owner disables during a batch; workflow saves resume cursor and stops.
4. **Duplicate test:** repeated input does not duplicate emails, CRM writes, invoices, orders, or Slack posts.
5. **Instance-pressure test:** a failing API or slow node cannot create unlimited retries.
6. **Recovery test:** a human can resume or replay dead-letter items with documented steps.
7. **Evidence test:** logs show the stop reason, counters, and last safe step.

## Paid kit tie-in

This checklist strengthens the OperatorForge AI Pro Pack because it turns starter workflows into safer client-ready automations. Pair it with:

- lead-intake responder template,
- quote follow-up assistant,
- review request automation,
- n8n client automation QA checklist,
- n8n silent failure and retry guardrails checklist.

## SEO notes

- Primary keyword: n8n kill switch checklist
- Secondary keywords: n8n runaway workflow, n8n circuit breaker, n8n workflow outage, stop n8n execution, n8n production checklist
- Search intent: operators and consultants whose n8n workflows can overload, loop, duplicate records, or become impossible to stop quickly.