# Feature flags are not authorization

Feature flags decide whether a UI or code path is rolled out. They do not decide whether *this* caller may read or change *this* resource.

A common mistake: gate a dangerous action behind `if (flagEnabled("billing_v2"))` and skip the authorization check because "only people who see the flag can click it." Flags leak. Clients get toggled early. Support tools and scripts ignore the UI. Attackers call the API directly.

Treat flags as product delivery. Treat authorization as a separate decision: subject, action, resource, and context — every time, on the server, for every request that mutates or returns sensitive data.

If the flag is off for everyone but the endpoint still accepts the call, your access control is not the flag.