Protocol Emergency Pause
A built-in switch letting designated parties freeze some or all of a protocol's functions during an attack or a discovered bug.
A pause is typically a function callable only by a guardian address or a multi-signature wallet, which sets a flag that blocks deposits, borrowing, or transfers until it is cleared. It exists because exploits unfold in minutes and a pause is the only way to stop an ongoing drain, and several protocols have preserved substantial funds by using one. It is also, unavoidably, a centralization and censorship vector: the same power can block legitimate users, and a compromised guardian key can freeze a protocol indefinitely. Careful designs bound it, by limiting the pause to a maximum duration, requiring a timelock to unpause, or restricting the guardian to pausing without any ability to move assets. Many stablecoin contracts include a related issuer-level function to freeze specific addresses, used in response to law enforcement requests.
In practice
A guardian role that can pause but cannot upgrade or withdraw limits the damage from a compromised guardian key to a denial of service rather than a theft.
The common misunderstanding
That a pause function means users can be made whole, when pausing stops further loss and cannot reverse transactions that have already settled.