Free n8n production-safety asset

n8n Runaway Workflow Kill Switch Checklist

A practical circuit-breaker, execution-budget, dead-letter, and outside-the-UI stop runbook for n8n builders who cannot let one bad workflow take down the whole instance.

Download PDFDownload Markdown

Built from fresh r/n8n pain around a single bad workflow causing a multi-hour instance outage.

10-minute quick pass

Build the stop path before production.

Use this before shipping any n8n workflow that loops, batches, fans out, calls paid APIs, or writes into production systems.

  • Name every runaway path: loops, batches, retries, webhooks, and AI branches.
  • Set hard limits for item count, runtime, external writes, and API spend.
  • Add a kill-switch flag the owner can change without editing the workflow.
  • Check that flag before costly calls, risky writes, and long loops.
  • Save dead-letter items with a resume cursor and last safe step.
  • Alert the owner only when a decision or cleanup is needed.
  • Test the outage drill before calling the workflow delivered.
Control plane

Choose a kill switch the owner can actually use.

Control sourceBest forOwner actionNotes
Google Sheet / Airtable rowNon-technical ownersChange enabled to falseVisible and easy to hand off
Static JSON / env variableSelf-hosted technical teamsEdit config and restart/redeployGood when infra owner is available
Database settings tableProduction appsToggle workflow settingStrong audit trail; requires access control
Upstream trigger pauseForms, email, webhooksDisable source temporarilyUseful when the n8n UI is frozen

Circuit-breaker pseudocode

Trigger
  -> Load control row for workflow_key
  -> If workflow_enabled != true: log paused and stop
  -> If runtime exceeds budget: dead-letter remaining items and alert owner
  -> For each batch:
       -> Re-check control row
       -> If disabled: save resume cursor and stop
       -> Process item with idempotency key
       -> Increment write/call counters
       -> If budget exceeded: alert owner and stop
  -> Save success evidence

Minimum control fields

  • workflow_key
  • workflow_enabled
  • max_items_per_execution
  • max_runtime_seconds
  • max_external_writes
  • alert_owner
  • last_reviewed_at
  • notes
Risk score

Decide how much guardrail the workflow needs.

0–3 points

Normal QA checklist is enough. Still document the stop path.

4–6 points

Kill switch required before delivery. Test disable and duplicate behavior.

7–10 points

Circuit breaker, dead-letter list, and owner outage drill required before production.

Outside-the-UI runbook

If the UI is frozen, the owner still needs a stop spell.

Every client handoff should include a plain-language stop path: pause the upstream trigger, toggle the kill switch, stop the worker/container if appropriate, preserve execution evidence, and resume only after duplicate/write review.

Download checklistRequest Pro Pack

Delivery acceptance tests

  • Loop fixture stops at the item budget.
  • Owner disables and next run exits cleanly.
  • Mid-batch disable saves resume cursor.
  • Repeated input does not duplicate writes or messages.
  • Slow/failing API cannot create unlimited retries.
  • Dead-letter items can be resumed manually.
  • Logs show stop reason, counters, and last safe step.
Paid kit tie-in

Add blast-radius control to the OperatorForge AI Pro Pack workflows.

This free checklist pairs with the lead-intake, quote follow-up, review-request, QA, retry, and no-hallucination assets in the Pro Pack.

Request purchase linkRead preview
  • n8n kill-switch checklist
  • Runaway workflow risk score
  • Control-plane field list
  • Owner alert template
  • Outside-the-UI stop runbook