Deploy and release are separate events. Code reaches production hidden behind a feature flag, and the release happens later, to a chosen audience, with a toggle. The team merges dark code into trunk daily; production receives everything while customers see nothing. Rollback becomes a seconds-long config change, with no commit revert and no maintenance window.

Every flag type gets its own lifecycle

Flags mixed into one pile become dead config entries. Give each category its own lifecycle: release flags live for days and die after 100% rollout; kill switches (ops flags) guard shaky dependencies for months; permissioning flags persist as plan entitlements; experiment flags follow the statistical calendar of the A/B test. Every flag starts with a registered owner and a planned removal date.

How does a progressive rollout work?

The classic ramp: 1% internal, then 5%, 25%, 50%, 100%. Between steps, the team watches error-rate and latency dashboards for 24 hours before unlocking the next tier. LaunchDarkly, Unleash, and Flagsmith ship percentage ramps ready to use; a homegrown config service covers the need with consistent hashing of the user ID, so the same person always lands in the same group. Server-side evaluation where viable avoids a bloated payload that hands your roadmap to competitors inspecting the JS bundle.

Kill switches on external dependencies

Every risky external dependency earns a flag. Payment provider down? Toggle to the fallback processor in seconds, with no emergency Friday-night deploy. Search, recommendations, and any call with an acceptable alternative path deserve the same treatment. Exercise each kill switch quarterly; a flag that never went through a shutdown can fail on incident day.

Controlling flag debt

  • CI marks flag code branches older than the agreed age (30, 60 days) and fails the build
  • Owner and expiry date are mandatory fields at flag creation
  • Stale-flag cleanup joins sprint rituals as a fixed board item

Test matrices explode with combinations: N simultaneous flags produce 2^N paths. Cover the default-off and default-on path of every flag, then sample critical combinations; full coverage collapses beyond five flags at once. Bootstrapping flags on page load keeps SSR consistent, with no flash between server render and hydration.