# A feature flag is not an authorization check

Feature flags are great for rollouts. They are a poor substitute for authorization.

A flag answers: “Is this code path on for this cohort?”
An authz check answers: “Is this principal allowed to do this action on this resource?”

Those questions diverge fast:
- Flags are often coarse (percentage, plan tier, experiment cohort).
- Permissions are per user, role, relationship, and resource.
- Turning a flag off should hide a UI — it should not be the only thing stopping a direct API call.
- Turning a flag on for “enterprise” does not grant every enterprise user every admin action.

Practical pattern: use flags to gate whether a capability is offered at all, then still call your authorization layer for every sensitive read or write. If someone crafts the request by hand, the flag being “on” for their tenant must not be enough.

Keep flags for product delivery. Keep authorization for access control.