Will the Agent Recuse, and Will It Stop? Measuring LLM-Agent Compliance with In-Band Governance Signals at the Access Door and Mid-Flight

As autonomous LLM agents hold real credentials and operate infrastructure without a human in the loop, operators cannot tell an agent a resource is off-limits, or ask a running agent to stand down. We propose an in-band governance signal -- the Recuse Signal -- that a server emits over a protocol's existing channels (an SSH banner, a PostgreSQL NOTICE, a Kubernetes admission warning) asking a connecting or running agent to voluntarily withdraw. It is a cooperative control (the robots.txt analogue for live access), not a security boundary; its value is empirical: do compliant LLM agents honor it? We define an open mini-standard (access-time deny/throttle/warn and mid-task halt), implement three live adapters (SSH, PostgreSQL, Kubernetes), and measure compliance over SSH across five agents. At the access door compliance is real but strongly model-dependent: recusal to deny ranges from 100% to 55-75% among agents that received it, while an open-weights agent barely engaged. Agents honor directive granularity (no over-recusal on throttle/warn, 0/176), but throttle showed no measurable self-limiting and no agent surfaced a warn (0/100); an authorization framing flips GPT-4o to proceed. Mid-flight a halt is weaker and, like the door, model-dependent: for two OpenAI models it stopped nobody (0/40; an in-band halt went unacknowledged, 0/20, vs 20/20 by prompt), but on the same apparatus Gemini 2.5 Flash stops 80% while GPT-4o-mini reproduces the 0%, so the null is model-scoped, not universal. Since cooperation is unreliable we also measure the backstop: a harness-level interceptor stops the loop 120/120 across six models (deterministic) vs a 23% cooperative baseline. Cooperative signaling is reliable-but-model-dependent at the door and weaker in flight; reliably stopping a running agent needs enforcement, not a request. We release the standard, adapters, and harness.