Each feature of our service can be individually enabled or disabled. If a feature turns out to have negative consequences, such as security holes or unexpectedly bad performance, it can be disabled without deploying a different software release.
This can be a little tricky because of the combinatorics problem of having many switches that each introduce a new degree of freedom. How do you build confidence that any constellation of switch states is healthy, valid, error free? Defining the 'feature' lines appropriately here can be critical.
