Kill switch
A single toggle that instantly disables a risky feature or integration in production, no deploy required.
See it
What it is
A kill switch is a feature flag with one job: turning something off fast. Flip it in a dashboard and the risky code path, the flaky third-party integration, or the expensive AI call stops running for everyone within seconds, with no build, no deploy, no rollback queue. It is the difference between a five-second incident and a twenty-minute one.
Reach for it any time you ship something you are not fully sure of: a new payment provider, a recommendation model, an email blast, a background job that hammers the database. Wire it at the boundary of the risky thing so flipping it drops you back to the old behavior rather than to an error page. Tools like LaunchDarkly, Unleash, or a single row in your own config table all work.
Gotcha: an untested kill switch is decoration. If the 'off' path has never run in production, it will break the first time you need it, usually at 2am. Exercise it on purpose, keep the flag check cheap and cached, and make sure it fails closed if the flag service itself is down. Also clean up dead switches, or you end up with hundreds of flags nobody dares delete.
Ask AI for it
Add a kill switch for this feature. Put the risky code path behind a single boolean flag read at runtime from a config service or feature flag provider, cached with a short TTL, defaulting to 'off' if the flag source is unreachable. When the switch is off, fall back to the previous safe behavior instead of throwing, log the fallback, and emit a metric. Expose the toggle somewhere an on-call engineer can flip it in seconds without a deploy, and add a test that runs the disabled path.