Kill Switch

What it means

A kill switch is an operational feature flag reserved for turning something off fast. Rather than gating a rollout, it exists so that when a feature, integration, or expensive code path starts causing problems, an on-call engineer can disable it with one click. Because flag changes propagate through SDKs in near real time, the effect is immediate across every running instance, with no build, no deploy, and no waiting for a rollback to roll through your fleet. Kill switches are long-lived by design and often wrap third-party dependencies, resource-heavy features, or anything that has caused an outage before.

Why it matters

The value of a kill switch is measured in mean time to recovery. Rolling back a deployment can take many minutes and may drag in unrelated changes; flipping a flag is nearly instant and surgical. That makes kill switches a core part of incident response - teams pre-wire them around risky subsystems so that mitigating an outage does not require a code change under pressure. They also enable graceful degradation, letting you shed a failing feature while keeping the rest of the product up.

In practice

A payment service might wrap each external processor in its own kill switch so a flaky provider can be cut over without touching the checkout deploy. Platforms like LaunchDarkly and Unleash support this with instant propagation, audit logs of who flipped what, and permissions that let on-call staff toggle ops flags without full flag-editing access. See what is a kill switch for wiring patterns and our rollout strategies guide for where they fit.