Kill switch

A pre-built control that disables a feature or dependency without a deploy. It converts a bad change from an incident measured in deploy cycles into one measured in seconds, which is why risky launches ship with one. The catch is that a kill switch nobody has exercised is a guess: it needs to be tested in production before it is needed, because the moment you need it is the worst moment to discover it does not work.