Comparison
Escape hatchvsKill switch
Escape hatch
the automation was doing the wrong thing at 2am and there was no supported way to turn it off.
A supported way to bypass the system when the system is wrong. Every automation needs one, because automation fails in ways its authors did not model, and the alternative is somebody editing the database by hand during an incident. Designing it deliberately — audited, obvious, documented in the runbook — is the difference between a controlled override and an unrecorded one.
Full entry →Kill switch
the new code path was on fire and you turned it off with a flag instead of a rollback.
A pre-built control that disables a feature or dependency without a deploy. It converts a bad change from an incident measured in deploy cycles into one measured in seconds, which is why risky launches ship with one. The catch is that a kill switch nobody has exercised is a guess: it needs to be tested in production before it is needed, because the moment you need it is the worst moment to discover it does not work.
Full entry →