Feature flags are not access control

Feature flags decide whether a capability is rolled out. Authorization decides whether this caller may use it.

Mixing them up is common: gate a premium endpoint behind if (flagEnabled) and skip the permission check because “nobody has the flag yet.” Flags leak. Clients change. Rollouts expand. Suddenly the gate is the only gate.

Keep them separate:

1. Feature flag: is the feature available in this environment / cohort?
2. Authorization: may this principal perform this action on this resource?

Both must pass. A flag that is on for everyone is not a permission. A permission that exists does not mean the feature is ready to expose.

If you only check the flag, you built rollout control — not access control.