A kill switch that depends synchronously on the affected control plane is not a reliable mitigation. Serving paths need a bounded last-known-good policy.
Statically Stable Release Kill Switch
A release control must remain operable when the released dependency is unhealthy.
type Snapshot = { version: number; validUntil: number; flags: Record<string, boolean>; signature: string }
async function refreshPolicy() {
const candidate = await controlPlane.fetch({ signal: AbortSignal.timeout(1_000) })
verifySignature(candidate)
if (candidate.version <= current.version) return
await snapshots.writeAtomically(candidate)
current = candidate
}
function enabled(flag: string) {
if (Date.now() <= current.validUntil) return current.flags[flag] ?? false
return safeDefaults[flag] ?? false // explicit per-feature failure policy
}Invariant: The last known-good release policy remains readable without the control plane.
Use when: A harmful release must be disabled even while the configuration control plane is unavailable.
Why this boundary matters
If disabling a release requires the failing service, control-plane impairment removes the safest mitigation exactly when it is needed.
Failure policy
| Boundary | Action |
|---|---|
| Fresh signed policy | Validate version and apply atomically |
| Control plane unavailable | Continue from the last valid snapshot |
| Snapshot exceeds max staleness | Apply the documented safe default |
| Version moves backward | Reject unless an authorized rollback token permits it |
| Signature invalid | Reject and alert |
| Emergency disable | Propagate through an independent, tested path |
Trade-offs
Local snapshots preserve mitigation during control-plane failure but introduce bounded staleness. Fail-open protects availability; fail-closed protects safety. The correct default differs by feature and must be explicit.
Decision rule: Use a statically stable kill switch for changes that can materially harm customers and must be reversible without depending on the affected data path.
Further reference
Browse all engineering snippets · Read about feature flags as production state