Quick-disable for single campaign

During an incident, operators are under time pressure — every minute a bad campaign runs increases complaints and risks ESP account action. A pause mechanism that requires navigating to an undocumented admin page, writing a SQL UPDATE, or finding the right API endpoint in source code adds minutes to incident response. NIST SP 800-53 IR-4 (Incident Handling) requires that containment actions are pre-planned and executable without discovery overhead. An admin UI button with no runbook entry fails because the runbook is what makes it findable under pressure.

Document the quick-disable procedure in your incident runbook with a ready-to-run command. For API-based pause:

# Emergency: pause campaign immediately
curl -sS -L -X PATCH https://your-api.com/api/admin/campaigns/CAMPAIGN_ID \
  -H "Authorization: Bearer $ADMIN_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"status": "paused"}'

Or the safe SQL equivalent if direct DB access is needed:

UPDATE campaigns SET status = 'paused', paused_at = NOW() WHERE id = 'CAMPAIGN_ID';

The procedure must appear in docs/runbooks/deliverability-incident.md or equivalent — an undocumented admin UI does not pass this check.