Kill switches & safe rollbacks
A kill switch is a flag whose off state is a known-good fallback. When incidents happen, the fastest mitigation is often a flag, not a deploy.
Make off the safe state
Design every flag so the default (off) is the behaviour you would want during an incident. If turning a flag off could itself cause problems, it is not a kill switch — it is another risk.
Keep the switch out of the request path
A kill switch is worthless if flipping it depends on the very system that is failing. Because FeatureGate evaluates from a local snapshot and pushes changes over streaming with a polling fallback, the switch keeps working even when the network is unhappy.
Retire flags deliberately
Kill switches and rollout flags are temporary by nature. Once a feature is fully live and proven, remove the flag and the dead branch. Leaving stale flags around turns your safety net into a maze.
- Name flags for what they gate, not the ticket number.
- Track which flags are temporary vs long-lived operational switches.
- Delete a flag and its code path in the same change.