The essential property is independence. A kill switch that runs inside the misbehaving process is not a kill switch. Venues and brokers provide external cancel-on-disconnect and mass-cancel facilities precisely for this reason.
Well designed systems trip automatically on breached loss limits, abnormal message rates or stale market data, and then require a deliberate human action to restart.
Example: a strategy's data feed goes stale and it starts quoting off prices 40 seconds old. A watchdog sees the staleness, trips the kill switch at 09:41:12, and the venue mass-cancels 84 working orders. Losses stop at $12,000 rather than compounding for the twenty minutes it takes someone to notice.
Related: pre-trade-risk-check, flatten, api-trading, order-to-trade-ratio