Flags that do not end at the toggle
Turning something on is the easy half. What a team actually carries is everything after: which environment, who approved it, what broke, and the branch nobody dares delete.
Evaluated in your process
The SDK holds your environment’s whole ruleset and resolves a flag locally. A flag check is a memory read, not a network call — it cannot be slow, and it cannot fail your request. When our control plane is unreachable the SDK keeps serving the last ruleset it had.
Targeted per environment
Development, staging and production hold their own targeting and their own keys, so the same flag is independently on in one and off in another. Production can require an approval before a change applies, and the kill switch never waits for one.
Removed when it is done
Every vendor can tell you a flag is stale. A scheduled agent run finds the flags serving one variant everywhere past their removal date, deletes the branch from your repository and opens one pull request per flag — held at an approval gate, never merged unattended.
Watched by Observer
A rollout that correlates with a new error group raises a finding naming both, with the occurrence count and how long after the change it appeared. Opt a flag in and the guard can kill it outright, writing its evidence to the flag’s history.
First match wins, and a kill beats everything
The same order in every SDK, proved by one shared fixture. A port that returns the right answer for the wrong reason fails it.
- 01KilledNothing overrides a kill.
- 02PrerequisitesA gate flag must be serving its variant.
- 03Rules, in orderFirst match wins — clauses and segments.
- 04RolloutBucketed on a hash of the flag key and the subject.
- 05DefaultWhat everyone else gets.
The answers, before you ask for them
No certification claimed that we do not hold. What follows is what the product does today.
Bring your own model credentials. We never hold the bill for your agents.
Every change records who, what, which environment, before and after.
Production changes can be held until a second person decides. You cannot approve your own.
A browser or mobile key receives evaluated values, never your targeting rules.
Beats every rule, applies instantly, and preserves the targeting underneath it.
On every plan. You pay for environments and the flags you keep, never per check.
In closed beta
Launch is switched on for one workspace while the flag-removal agent is proved against our own repository. SDKs for Node.js, Python, Go speak OpenFeature, so nothing you write against it is ours to hold onto.