Feature Flags, Kill Switches, and Rollouts

A feature flag selects behavior without replacing the app binary. A kill switch is intended to disable risky behavior quickly.

These controls need a defined scope, safe defaults, and a specific enforcement point. Their names alone do not establish how quickly or reliably they work.

Treat configuration as validated data

A remote configuration contract should define:

• A revision identifying the configuration.
• Supported app versions and feature eligibility.
• Typed values and allowed bounds.
• A freshness or expiration policy.
• Bundled defaults for first launch.