Every Feature Flag Needs a Removal Date and Incident Owner

Classify every flag before release

Release, experiment, permission, and operational flags have different lifetimes and failure semantics. Record the type, owner, default, expected lifetime, removal issue, and incident use before merging the branch. OpenFeature Specification supplies the primary specification or operating model for this decision.

Trace a checkout flag through failure and removal

A checkout kill switch should fail to the safer degraded behavior, emit evaluation health, and have an on-call owner. A short release flag should be removed after rollout. Permission flags must not quietly become an ungoverned authorization system. Unleash feature flags provides the complementary protocol or operational detail.

Give the flag a lifecycle record

Create each flag with owner, purpose, safe default, target audience, creation date, removal date, incident contact, and the release condition that makes it obsolete. Distinguish release flags from operational kill switches and long-lived entitlements; they have different access and retention needs.

Application code should define behavior for provider timeout, missing key, malformed value, and stale cache. A checkout kill switch may fail to the conservative path, while a cosmetic experiment can use its cached value. Record evaluation reason and flag revision without logging user traits.

Remove both branches deliberately

Test enabled, disabled, and provider-unavailable paths before rollout. Watch unknown-key evaluations and target drift. When exposure reaches its goal, decide which branch survives, delete the other code, remove tests for the dead path, then remove configuration after every deployed version no longer references it.

An expired flag should page its owner or fail a repository check, not remain an ignored dashboard row. Inventory flags older than one release cycle and select the five with highest execution volume. For each, schedule deletion or document why it is actually an operational control with a new review date. Include server, worker, and client references in the deletion search because a flag can survive outside the repository that created it.