Use a kill switch when one capability must stop now and the rest of the system is fine. Use a release flag when a new feature is misbehaving and you shipped it dark. Use a rollback when the problem is in the code or config of the release itself, or you cannot isolate it.
The three tools
A kill switch is a long-lived ops toggle. Fowler describes these as controls that let operators gracefully degrade non-essential features and that must change faster than a release.
A feature flag, in his taxonomy, can be a release toggle (hides unfinished code, short lived), an experiment toggle, an ops toggle or a permissioning toggle. Each category lives for a different time and decides differently, so manage them differently even if one tool serves them all.
A rollback redeploys the previous known good version.
Comparison
Speed: kill switches and flags take effect in seconds if the flag system is healthy. Rollbacks take as long as your pipeline and rollout take, plus warm-up.
Scope: a switch affects one capability. A rollback reverts everything in the release, including fixes you wanted to keep.
Risk: a flag flip changes behavior without changing the code, but the off path may be untested. A rollback returns to code that ran before, yet data migrations, schema changes and cache formats can make going back unsafe.
Dependencies: a flag depends on the flag service. A rollback depends on the build and deploy system. Know which of these may be down during your incident.
A decision order
- Is the harm security related and ongoing? Contain first. Tighten with a switch if one exists.
- Is the bad behavior behind a flag or switch? Turn it off.
- Did a database or schema change ship with it? Check whether rollback is safe before you try.
- Is the cause unknown? Roll back to the last known good, then investigate.
- After recovery, write down what you would have wanted.
Make it routine
Practice the rollback and the switch in a game day, not for the first time at 2 a.m. Fowler also advises removing toggles when no longer needed, with expiration dates or time bombs that fail tests after expiry, so you do not drown in dead flags.
Quick check
Can flags replace rollbacks?
No. Flags cover features you wrapped in advance. Rollback covers the cases you did not predict.
What if the flag service is down?
Define default values in code and cache the last known state, and keep a rollback path that does not depend on the flag system.
Sources
Last reviewed: 19 October 2026.
