Kill switch

Common triggers: a third-party dependency starts timing out, a new feature spikes database load, or a bug surfaces only under production traffic. Wrapping risky or resource-heavy behavior in a flag means the mitigation is a single switch rather than an incident-length revert. Teams often pair a kill switch with a percentage rollout so they can both ramp exposure up and cut it to zero instantly. For a fuller walkthrough of what to wrap and how to choose a fail-safe default, see using a kill switch in production.

A rollback reverts a deployment: it is slower (rebuild and redeploy), coarse (it reverts everything in that release, including the working parts), and risky during an incident. A kill switch is scoped to one feature and takes effect on the next flag evaluation. The new code stays in the binary, and no traffic executes it, so you can triage the root cause without the clock running.