360 Secure SkillHub
360 安全技能中心

Feature Flags

围绕功能开关的分类、定向规则、评估一致性、安全与 kill switch、生命周期清理和治理提供六阶段工作流指导,帮助区分部署与发布并控制开关债务。适用于渐进发布、实验和客户端/服务端评估场景。

mike47512
mike47512
热度 12.79
最近更新 2026-07-10 09:49:55
分类:开发依赖:纯提示词应用场景:DevOps / 工作流 / 概念解释

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add feature-flags
Metadata
name
feature-flags
description
Deep feature flag workflow—taxonomy, targeting, lifecycle, safety and kill switches, cleanup, and governance. Use when shipping gradually, experimenting, or decoupling deploy from release.

Feature Flags

Flags decouple deploy from release—and become debt if never removed. Taxonomy, ownership, and retirement matter as much as targeting.

When to Offer This Workflow

Trigger conditions:

  • Gradual rollouts, kill switches, or experiments behind flags
  • Flag sprawl and unknown defaults
  • Client vs server evaluation and hydration flicker

Initial offer:

Use six stages: (1) taxonomy, (2) targeting rules, (3) evaluation & consistency, (4) safety & ops, (5) lifecycle & cleanup, (6) governance). Confirm provider (LaunchDarkly, Unleash, ConfigCat, homegrown).


Stage 1: Taxonomy

Goal: Separate short-lived release flags, long-lived config flags, and experiment flags tied to analytics.

Exit condition: Naming convention and expected TTL per type.


Stage 2: Targeting Rules

Goal: Percentage rollouts, segments (tenant, plan, region), deterministic bucketing (stable user key).


Stage 3: Evaluation & Consistency

Goal: Server-side authoritative for security and billing; client flags for UX only; avoid UI flicker on hydration (SSR/CSR agreement).


Stage 4: Safety & Ops

Goal: Kill-switch runbook; audit trail for changes; safe defaults when provider unavailable (often “off”).


Stage 5: Lifecycle & Cleanup

Goal: Tickets to remove flags after full rollout; periodic audits; metric for stale flags.


Stage 6: Governance

Goal: Approvals for broadening exposure; promotion across environments; break-glass access for incidents.


Final Review Checklist

  • Flag types and naming documented
  • Targeting and bucketing deterministic
  • Server vs client boundaries clear
  • Kill switches and defaults documented
  • Cleanup process and ownership

Tips for Effective Guidance

  • Never put security-only gates solely in client-side flags.
  • Pair with ab-testing when experiment analysis is primary.

Handling Deviations

  • Align with release-management for communication cadence.