Agents Need Feature Flags - Sachin Gupta

AI Engineer · 19 min · 272 sentences · from YouTube's caption track

Each timecode opens YouTube at the start of that sentence. Line anchors (#s42) are the cue ids in the WebVTT, and every line carries its start and end seconds. All transcripts has every talk, and the whole corpus as one file.

00:00Hello everyone, I'm Sachin Gupta and I'm a backend engineer and today we are going to talk about agent need feature flags.
00:08If you have been a backend engineer for any length of time, you already know these tools.
00:14Things like canaries, segment targeting, kill switches, your craft has had them for over a decade and none of them is new.
00:23The boring infrastructure that keep deploy safe is already a solved problem.
00:29What is new is that we are shipping the most behavior changing systems we have ever built agents that send money, agent that send mail, agent that modify databases, agent that spawn child processes
00:43and we are shipping them with none of that infrastructure.
00:47We are shipping them the way web team used to ship in 2008.
00:52Over the next few minutes, here is the plan.
00:55I will walk you through with the six flag types that agents specifically need.
01:00I will show you two live demo storyboards.
01:03The first is flipping a tool midcon conversation.
01:06The second is stopping a runaway agent mids sentence.
01:10Then I will cover a rollout playbook with the numbers your team should track from day one.
01:17Let's go.
01:20Here is a situation today.
01:22The moment your prompt change merges, 100% of your users see the new behavior.
01:27There is no canary, no segment, and no roll back button.
01:32Look at what goes out under those small all or nothing rules.
01:38We get prompt rewrite, new tool addition, model swapping, memory policy changes, autonomy upgrades, system instruction edits, and we get all of it globally and instantly.
01:51Web teams stopped doing this back in 2012 and they stopped doing it for changes that were less risky than this.
01:59The story that you actually hear from teams almost word for word is that it's just a small prompt peak maybe broke a couple of a chunk of users and then finally
02:10people are finding it out on discord links or Tik Toks or maybe another social media platform.
02:18So that is the failure mode this entire talk is built around and let me show you that it is not hypothetical.
02:31These are the four named incident in the last 14 months.
02:35The first one we have is cursor sam that happened in April of 2025 where the support bot confidently told users about a policy that never existed.
02:46The second one we have is replet.
02:48This was day nine of a 12-day wipe coding experiment.
02:53The agent did not follow the instructions and ended up deleting the production database and then fabricated over 4,000 fake users to conceal what it had done.
03:03The third one is LANC chain.
03:05It had a four agent pipeline researcher, analyzer, verifier, and synthesizer where two of them ran in continuous loop and costed $47,000.
03:16The fourth one is pocket OS where a developer was using cursor and claude.
03:21The AI coding agent grabbed an unrelated API token from another file, treated it as authoritative, and ran a railway graphql drop on the production database.
03:33On the bottom left, you will see the sources that I used to site it.
03:42Web engineers learned this lesson a decade ago.
03:44Canary releases.
03:45You ship to a few percentage of users.
03:47You watch the matrix.
03:49If it works, you expand.
03:50If it doesn't, then you roll back.
03:53Segment targeting.
03:54Different behavior for different type of users.
03:56Kill switches.
03:57Pre-wired off toggles that take effect in seconds, not in deploy cycles.
04:02Rollout monitoring.
04:03Every change has its own error rate dashboard.
04:06None of this is new.
04:07The tooling already exists like launch darkly, unleash lift or maybe your homegrown flag service.
04:13This is already a solved problem.
04:14The discipline is already there.
04:16We just have to apply it.
04:19But now the problem is that web feature flags covers one thing whether a feature is on or off.
04:25But agent has six behavior surfaces that a cred app does not have and each one needs its own kind of flag.
04:33And in the next slide we are going to see that these are the six behavior surfaces that a cred app does not have.
04:40First one is prompts.
04:42The system prompt is your most behavioral altering code.
04:44It changes weekly sometimes daily often outside your normal deploy processes.
04:49Tools.
04:50Every tool the agent can call is the new authorized action.
04:55Tools comes and go faster than features ever did.
04:59Models.
04:59Model of the week swap change personality, refusal patterns, latency, and cost.
05:05Sometimes in subtle way you won't even notice for days.
05:08Memory.
05:09What the agent remember across session silently changes behavior over time.
05:14The same prompt reduces different output for the same user as memory accumulates.
05:21Autonomy, suggest versus auto approve versus autoexecute.
05:26The single largest blast radius tile you own.
05:30Sub aents.
05:31These are the spawn children inherited from the parent flags or they should most system don't enforce it.
05:39A boolean feature enabled flag doesn't cover any of these.
05:43You need a taxonomy.
05:49So here it is six type one for each surface prompt variant tool access model routing memory policy autonomy level and the kill switch.
05:59Each one maps to a behavior surface.
06:02None of them require building a new flag back end.
06:05Let me walk through them fast.
06:09Prompt variant flags route different users to a different system prompt version on the fly without a deploy.
06:16Look at the example.
06:17The beta cohort get experimental V3 which is concise and action first.
06:22Paid tier gets V2 which is warm and expensive.
06:26Everyone else gets V1 which is stable and well tested.
06:30Cursor SAM is what happens without this.
06:33There was no controlled variant just one model doing its best.
06:37It got things wrong differently for each user.
06:40With a prompt variant flag you roll the new prompt to 5% of beta traffic.
06:45You watch the hallucination rate.
06:47You watch the escalation rate.
06:49And then you promote when it holds.
06:52Tool access flags authorize or revoke specified tools per user segment, per user type, per risk class.
07:00The tool exists in your codebase whether the agent can call it.
07:04It is the flag.
07:05This is mandatory when your agent has money moving tools, data deleting tools or compliance sensitive tools.
07:12you scope per customer tier or you pay the AML or socks bill along the way.
07:19It prevents the usual broken tool ship.
07:22The prompt plus send email massmail incident and the beta tool that leaks to prod users through coding d uh through config drift model routing flag decide which model handles which traffic.
07:35They let you migrate fallback or canary without code changes.
07:39The high cost segment gets the frontier model.
07:42The free trial gets the cheap first model and on an incident, one flip puts you to a stable fallback.
07:48The lesson is extremely simple.
07:51On the day a provider deprecates a model or pulls one for safety or has a multi-hour outage, a model routing flag is the difference between flipping a switch and shipping a hot fix in the middle of an incident.
08:04If your production system has a hard dependency on one model from one provider and it does not have any routing flag, no fallback, you are one provider outage away from a complete agent outage
08:18or maybe one deprecation notice and everything is gone.
08:22Route your traffic have a fall back.
08:25Make it a flag.
08:28Memory policy flag controls what the agent remember across sessions.
08:33These are four dimensions and each of them are independent.
08:37The first one is retention.
08:39It could be session only.
08:40It could be 30 days or forever.
08:42Scope.
08:43It could be per user, per tenant or maybe global.
08:46Write enabled.
08:48Whether the agent can persist memory for this segment at all or not.
08:52User visible.
08:53Whether the user can inspect and delete their own.
08:56They all look small but they are not.
08:58The privacy posture of your product lives here.
09:01The consistency of your agent behavior lives here.
09:04Your compliance story with GDPR and EU AI act lives here.
09:10Autonomy level flags.
09:11This is the single biggest blast radius dial you own.
09:15There are three settings.
09:16Suggest where the agent recommend and a human acts.
09:20Auto approve where the agent prepares and a human one click confirms.
09:24And autoexecute where the agent just does it.
09:28The kill switch pre-wired off agentwide and poor surface.
09:32It does not require any deployment, does not require any start, does not require any code changes.
09:39Three properties that make a kill switch a real kill switch.
09:43First, you flip it and the change takes effect in seconds, not in a deployment pipeline.
09:49Second, inflight request respect the flag at the next decision point.
09:55Third, the wiring exist from the agent design phase, not at 3:00 a.m. hot patch when something is on fire.
10:03Without one, here is what you're going to get.
10:08First, Lchain, second pocket OS, third replet, and fourth is open clock.
10:15Now, think if you had a kill switch, if you could just have terminated the operation in between, it would have changed the game altogether.
10:25Okay, now is the time for the demo.
10:27The setup is basically assume you are in the April 2025 where the cursor sort bot is confidently citing a policy that is not present.
10:38So the way we think we can fix it is with the tool access flag.
10:42On the left you see we are having a conversation on the right the fix.
10:47So the moment we switch off this flag it will say it's disabled it at this time.
10:54by this person.
10:55This is the scope.
10:57This is what it applies and these are the active sessions.
11:00The moment the flag is flipped, you will see that instead of citing a wrong policy, it is saying I can draft this for you, but I'm not able to send emails right now.
11:11Want me to copy the draft into your clipboard instead?
11:15Now, this is a graceful error.
11:17Instead of giving me the wrong details, it is telling me that it cannot perform the operation.
11:24Now the money shot.
11:26The setup here is it's November 2025.
11:29A four agent Langchain pipeline loop for 11 days and burned $47,000.
11:35The agent system never noticed.
11:37The billing dashboard tripped the threshold.
11:40The chart on the left is tool calls per minute.
11:43This is an illustrative simulation.
11:45Baseline is 4 to8.
11:47The agent enters a runway loop.
11:50The line climbs rapidly.
11:51At t + 15 seconds, the raid guard fires a slack alert.
11:55At t + 2022, I flip the agent to kill it.
12:00At t + 2026, every inflight agent process sees the flag at its next decision point.
12:07Each one emit a graceful shutdown.
12:10At t + 30, the cost graph flattens.
12:1430 seconds from problem to mitigation without any deployment, without any restart, without any code changes, no incident channel paging.
12:24And this is what you get with the kill switch.
12:27Now the question is where the flag layer is actually living.
12:31If you see this architecture is extremely simple.
12:34There are three boxes.
12:35user on the left, a middleware layer in the middle which resolve the flag, gets the tools, route the models, applies autonomy and honor the kill switch and the agent loop on the right with model tool memory and sub agents.
12:49The agent loop is unchanged from whatever you have today.
12:53Below the middleware is your flag back end which is unleash flip launch darkly or maybe homegrown.
13:00You are not building a new one.
13:02The critical architecture rule is on the call out at the bottom of the slide.
13:07Sub agents must go through the same middleware.
13:11The biggest failure mode I see is a parent agent with flags properly applied that spawns a child agent.
13:18The child call the model and the tools directly but bypass the middleware entirely.
13:24The kill switch you just flipped never reaches it.
13:28So wire the middleware into every agent that is being spawned not just at the entry point.
13:35So this is the rollout playbook.
13:37Five steps in exact order.
13:40Step one, kill switch first.
13:42Wire a single agentwide kill switch and one per tool kill switch.
13:47Ship those before anything else.
13:49The step two is wrap the tools.
13:51Every tool call resolve a flag before execution.
13:55Step three stage autonomy.
13:57Default everything to suggest.
13:59Auto approve per surface as you build trust.
14:02Auto execute is optin per tool.
14:05Step four is variant prompts.
14:07Move the system prompt out of the code and into a flag resolve config.
14:13Step five, watch the slope.
14:15What does watch actually mean?
14:18Four numbers you should track from day one.
14:21These are on the right side of the slide.
14:23The thresholds I'm about to give you are suggested defaults.
14:27Tune them as per your requirement, your surface, your severity, your traffic class.
14:32First one, kill switch fires per week.
14:35The target is zero.
14:37If you have more than two a week, then investigate roll back time to mitigation.
14:42Target is under 5 minutes for a kill switch and under 30 minutes for a prompt roll back.
14:48If you're slower, your mitigation doesn't fit inside a real incident window.
14:53Canary error rate delta.
14:55If a new prompt variant error rate climbs more than 2% over baseline at 5% rollout, block the promotion flag audit trail completeness.
15:06100% required.
15:08If you cannot audit, who flipped, what is flipped, when it was flipped, then you cannot debug an incident in retrospective.
15:21Five failure modes that I have watched play out at multiple teams.
15:25Flag resolved at session start, not per turn.
15:28Your kill switch actually fired, but inflight conversation don't see it until the next session.
15:34Sub agents bypass the middleware.
15:36This one we have already covered.
15:38We need to make sure that we wire the middle middleware into every spawn.
15:45Context drift flags.
15:46The user segment at turn one is stale by turn 20.
15:50Log the segmentation context at the conversation level.
15:54Caching defeating the flip.
15:57Aggressive caching at your LLM gateway returns the old prompt response even after the flag is flipped.
16:03No alert on kill switch fires.
16:05The switch goes off silently.
16:07The product owner finds out next week.
16:10Every kill switch fire is a page on its own.
16:15In this slide, what you are seeing is the two parts to the business case.
16:18On the top half, the five questions every enterprise buyer will ask you in the next 12 months.
16:24Can you show me the kill switch?
16:26What's your rollout policy for prompt changes?
16:28How do you isolate beta features from production users?
16:31When a model behaves badly for one cohort, how fast can you mitigate?
16:36Who can flip these flags and is it audited?
16:39If you cannot demo all five, you are going to lose the deal.
16:43Flags are the demo.
16:45And on the bottom half, this is no longer just a sales question.
16:49It's a regulation.
16:50EU AI act, Mopar versus Air Canada, Garcia versus Corrector AI.
16:57These are the four habits that actually defeat the whole point.
17:01Kill switches rot.
17:02They get wired on day one and then never trade.
17:056 months later, a config migration broke the flag and the time you need it, it does not fire at all.
17:12Flag scrolling.
17:13You have 600 flags, no documentation.
17:16Every flag is a hidden coupling between the unrelated systems.
17:20Every flag needs an owner and a removal date.
17:23The temporary flag, it is shipped for a roll out.
17:26It was never removed.
17:285 years later, it's somehow loadbearing.
17:30Kill it immediately after the roll out is done.
17:33Flagdriven prompt.
17:34It fs that nobody test the street.
17:37Six prompt variant live in a production.
17:40Each individually works.
17:41Together they are amaze.
17:43Test the cartician product.
17:47Now these are the three things that you should remember.
17:50First one and the most important one in my opinion.
17:52Ship the kill switch first.
17:54If you do nothing else, give your agent one agentwide kill switch and one per tool kill switch.
17:59They take effect in seconds.
18:01No deployment is needed.
18:03That single capability changes your operational posture more than any engineering team investment in this particular quarter.
18:12Second one is treat the six surfaces independently and measure the slope prompts tools models memory autonomy sub aents.
18:21Each one needs its own flag type.
18:24On top of the taxonomy, track the four numbers, kill switch fires per week, time to mitigation, canary deltas, and audit completeness.
18:33Remember, 2026 was all about adoption.
18:372027 is all about control.
18:40The number three, match the discipline to the blast radius.
18:44Your boring web app sits behind canaries and segments.
18:48Your agent can send email, move money, modify database, and spawn children.
18:53It deserves at least the same discipline or probably more.
18:57Thank you very much.
18:59Build the kill switch this week.
19:01Everything else is the iteration on the same idea.
19:04Every incident on this deck is sourced.
19:06The curated case studies are linked on the screen at github.com/vectra/ awesome agent failures.
19:13Thank you very much.
19:14I'm Sachin Gupta.
19:15Thank you for watching.