A codebase has accumulated hundreds of feature flags, many years old. What went wrong, and what discipline prevents it?

What went wrong

Flags have a creation process and no removal process. Each was added for a legitimate rollout, the rollout completed, and removing the flag delivered nothing visible — so it lost every prioritisation comparison, every time.

The accumulated cost is real: each flag doubles the notional paths through the code, so a hundred flags make the actual behaviour of the system unknowable. Tests cover one combination; production runs another.

The discipline

• A flag is created with an expiry date and an owner, both mandatory. A flag past its date appears on a list somebody is accountable for.
• Distinguish flag types, because they have different lifetimes:
• Release flags — temporary, for a rollout. Removed within weeks. These are the ones that accumulate.
• Experiment flags — temporary, until the experiment concludes.
• Operational flags — permanent by design, such as a kill switch for a dependency. Legitimately long- lived, and should be labelled so they are not swept up in cleanups.
• Permission flags — not really flags; they are entitlement and belong in the permission model.
• Automated reporting of stale flags, with age, owner and current evaluation state — a flag returning the same value for every request for three months is dead.
• Removal as part of the rollout's definition of done, so the work is scheduled when the flag is created rather than negotiated afterwards.

The failure modes flags introduce

• Untested combinations. With many flags the deployed configuration has almost certainly never been tested. Testing the actual production configuration, generated from the flag service, is a partial mitigation.
• Flags read on the hot path from a remote service, making the flag service a hard dependency of every request. They must be cached locally with an indefinite fallback to the last known value.
• Flags that change behaviour in ways nobody documented, so the reason a flag exists is lost with the person who added it.

The framing

A feature flag is technical debt with a purpose and an interest rate. Taking it on is correct; not scheduling its repayment is what makes it expensive — and the repayment is small if done immediately and large if deferred a year.