Feature Flags: Rollout Strategies, Kill Switches, and Flag

Feature flags let you deploy code without releasing it, ship to a subset of users, and roll back a bad change in seconds instead of minutes.

Feature Flags: Decoupling Deploy From Release

A feature flag (or feature toggle) is a runtime switch that decides which code path executes for which user. Deploy the flag off; enable it for internal users; then 1% of traffic; then 10%; then everyone. If something breaks, flip the switch — no rollback deploy required. The pattern is worth adopting the day you have paying customers.

Four kinds of flags, four lifecycles

Release flags — hide unfinished code shipped to main; short-lived (days to weeks); delete once the feature is fully launched. Experiment flags — A/B test alternate implementations; medium-lived (weeks); delete once the winner is picked. Ops/kill-switch flags — long-lived (months to years); disable expensive features under load, cut off a broken integration, defer non-critical work. Permission flags — long-lived; gate features by plan, role, or account. Each has different governance: release flags need aggressive cleanup, ops flags need documentation of when to flip.

Rollout strategies

(1) Internal-only — enable for employees, dogfood for a day or two. (2) Percentage rollout — 1% → 5% → 25% → 100% with monitoring at each step. (3) Cohort rollout — specific customers, plans, or regions first. (4) Ring deployment — canary tenants, then early-access opt-ins, then general availability. Always pair rollout with monitoring: error rate, latency, and product metric for the flagged path. Automate the abort: if error rate on the flagged code path exceeds a threshold, auto-flip to 0%.

Tooling: build vs. buy

Buy for anything beyond simple boolean flags. LaunchDarkly is the enterprise default (expensive, feature-rich); Statsig and PostHog offer flags + experimentation together; Unleash and OpenFeature are open-source; ConfigCat is the low-cost option. Roll-your-own is tempting and turns into a permanent side project — you'll want percentage rollouts, targeting rules, an audit log, and an SDK for every language, and you'll end up rebuilding a flag platform poorly. Buy from day one; the cost is trivial compared to the incident it prevents.

Flag hygiene, or how to avoid a graveyard

Every release flag has an owner and a delete-by date at creation. Weekly report: flags older than 60 days without a delete-by date. Monthly ritual: flag cleanup PRs — remove the flag, remove the dead branch, close the ticket. When a flag has been at 100% for 2 weeks, that is your cue to delete. A codebase with 400 flags is one that no one can reason about; a codebase with 40 well-labeled flags is a superpower. Treat flag deletion as a first-class engineering activity, not tech-debt-someday.

The dangerous cases

Never flag security controls (authentication, authorization, encryption) — a flag flip that turns off authz is a breach. Never flag database migrations one-way — you cannot roll back a dropped column with a flag. Avoid deeply nested flags (flag inside a flag inside a flag) — the combinatorial state space is untestable. Watch out for flag drift across environments (dev, staging, prod diverge silently). And remember: a flag that has never been flipped in production is not tested; run flip drills for critical kill switches.

Frequently asked questions

When do we adopt feature flags?
The day you have paying customers and more than one deploy per week. Start with a single tool, a single boolean flag on your riskiest next launch, and expand from there. Do not wait for a platform-team-driven adoption — it never happens.
How do flags interact with A/B testing?
An A/B test is a flag with random assignment and outcome tracking. Modern flag platforms unify the two (LaunchDarkly Experiments, Statsig, PostHog Experiments). Keep the semantics separate in code: a rollout flag and an experiment flag serve different lifecycles even when the same infrastructure powers them.
What about mobile clients where users don't update immediately?
Flags reach mobile via the SDK check on app launch or on a foreground refresh. Plan for staleness — a user on an old app version may see a flag state that differs from web. For critical kill switches, force-refresh flag state before the flagged code path executes.

Related fundraising guides (40)

Investor directory · Fundraising library · Articles A–Z · Company funding database