Module Registry with Kill Switches
Platforms accumulate features faster than operators can safely control them; disabling one shouldn't need a deploy. Register every feature as a module with explicit dependencies, default state, and a kill switch. Misbehaving features are stopped instantly, contained, without surgery — degradation and governance as a default.
Problem
Large platforms accumulate features faster than operators can safely control them. When a feature misbehaves, disabling it often requires a deploy, a config edit, or emergency database surgery.
Context
Use this pattern when a platform has optional modules, market-specific capabilities, staged rollouts, risky integrations, or features whose failure should not take down the whole product.
Forces
- Operators need immediate control when a feature causes harm.
- Product teams need to ship features without making every release globally irreversible.
- Users should not see or call features that are unavailable in their scope.
- Disabled must mean unable to act, not merely hidden from one screen.
- Feature state itself can drift unless it has one governed home.
Solution
Register every feature as a module with explicit dependencies, default state, lock state, and configuration requirements. Resolve module state per scope. Use module state to hide UI and block writes. Treat the registry as the control surface for degradation, not as a decorative feature list.
Consequences
Operators gain immediate control. Features become independently governable. Risky functionality can be shipped behind precise controls. The platform becomes safer to evolve because degradation is a designed path, not an incident improvisation.
Failure Modes
- The UI hides a feature but the API still accepts writes.
- A kill switch disables new use but leaves workers, retries, or scheduled tasks running.
- Feature dependencies are implicit in code instead of declared in the registry.
- A disabled feature can still emit side effects through imports, migrations, or admin tools.
- Teams bypass the registry because a one-off flag is faster.
Proof Points
reservations, financial functions, and SADIE-style delegation need explicit operator control.
- Ampriot — product modules, scene management,
Full source pattern: 04-module-registry-kill-switches.md.