Managing a risky release with feature flags

WHAT THIS TESTS: Whether you understand the operational value of feature flags, decoupling code deployment from feature release, and can describe a disciplined, reversible rollout lifecycle.

A GOOD ANSWER COVERS: First, deploy the code to production with the flag off, so the feature ships dark with zero user impact and deployment risk is separated from release risk. Then begin a progressive rollout: enable the feature for internal or employee users first to catch obvious problems, then for a small percentage of real users as a canary. At each step, monitor the signals that matter, error rate, latency, and business or feature-specific metrics, comparing flagged versus unflagged cohorts. If anything regresses, flip the flag off instantly, an immediate kill switch that is far faster than redeploying or rolling back. If metrics stay healthy, ramp the percentage gradually (for example 1%, 10%, 50%, 100%), continuing to watch at each tier. Once the feature is fully rolled out and stable, complete the lifecycle by removing the flag and the old code path to avoid accumulating technical debt from stale flags.

COMMON WRONG ANSWERS: Flipping straight to 100% with no canary or monitoring, defeating the purpose. Treating the flag as a permanent fixture and never cleaning it up, leaving a tangle of dead conditionals. Forgetting to monitor business metrics, not just system health, since a feature can be technically fine but harm conversion.

LIKELY FOLLOW-UPS: How do you target flag cohorts (percentage, user attributes, regions)? How do you prevent stale-flag debt at scale? How do flags interact with database migrations that are not reversible?

ONE CONCRETE EXAMPLE: A new recommendation algorithm ships behind an off flag. It is enabled for staff, then 1% of users; latency and click-through look good, so it ramps to 10%, 50%, then 100% over a few days. When an early 1% test showed elevated errors, the flag was flipped off in seconds with no redeploy. After a stable week at 100%, the flag and the old code path are deleted.