Feature flags and kill switches
A feature flag is a runtime switch that turns a piece of behavior on or off without deploying new code. It decouples release from deploy. Code can ship dark, disabled, and be turned on later for a chosen audience.
What flags enable
- Gradual rollout to a percentage of users, watching metrics as you widen
- Targeting, enabling a feature for internal staff or one region first
- Experiments, comparing variants by flipping users into groups
A kill switch is a special flag whose job is to disable a risky feature instantly when something goes wrong. Because flipping a flag is far faster than rolling back a deployment, a kill switch is your fastest mitigation during an incident.
The discipline they require
Flags are powerful but accumulate debt. Every flag is a branch in your code, and stale flags multiply untested combinations. Healthy practice:
- Remove flags once a feature is fully launched
- Keep the flag system itself highly available, since the app depends on it
- Provide a safe default if the flag service is unreachable
Key idea
Feature flags decouple release from deploy and give a kill switch for instant mitigation, but stale flags are debt that must be removed.