bestbee

A rollout reaches 80%, but one customer remains on the old path. The exception enters a spreadsheet as “temporary.” Six months later, nobody knows who approved it, which metric justified it, or whether removing the old path would break a contract.

The flag is no longer reducing launch risk. It is financing two products indefinitely.

A useful exception is a time-bounded decision with evidence. Use a ledger whose minimum record is:

exception: legacy-export-path
owner: platform-pm
population: enterprise-plan AND export_v1_contract
created: 2026-07-23
expires: 2026-08-20
reason: two customers need signed migration plans
evidence:
  population_count: 2
  weekly_uses: 14
  incidents_30d: 0
removal:
  engineering_days: 3
  customer_work: rotate integration endpoint
stop_rule: renew only with named customers and dated migration events

Enter fullscreen mode Exit fullscreen mode

Price the exception as a decision

Do not reduce cost to flag-service fees. A simple monthly estimate is:

exception cost = maintenance
               + duplicate testing
               + incident ambiguity
               + support handling
               + delayed deletion

Enter fullscreen mode Exit fullscreen mode

Worked example:

Cost Hours/month Loaded rate Monthly
Regression coverage 6 $100 $600
Support diagnosis 4 $90 $360
Release coordination 3 $110 $330
Expected incident work 2 $130 $260
Total 15 — $1,550

These are illustrative inputs, not a benchmark. Replace them with observed hours. At two customers, the visible carrying cost is $775/customer/month, before opportunity cost.

Use hard gates before arithmetic

A weighted score can create false precision. Check non-negotiable gates first:

  1. Safety: does removing the exception create data loss or an unauthorized action?
  2. Contract: is behavior contractually committed through a known date?
  3. Observability: can the team identify every affected request and customer?
  4. Reversibility: is there a tested rollback after removal?

A failed safety or observability gate blocks deletion. A failed ownership gate blocks renewal.

Then compare three options:

Option One-time cost Monthly cost Risk
Renew 30 days $0 $1,550 divergence grows
Migrate both customers $4,500 $0 after removal coordinated change
Productize both paths $12,000 $900 permanent complexity

If migration costs $4,500 and renewal costs $1,550 monthly, the simple break-even is about 2.9 months. Vary the uncertain inputs:

Monthly carrying cost Break-even
$800 5.6 months
$1,550 2.9 months
$2,400 1.9 months

The model does not choose. It reveals which assumption reverses the choice.

Make renewal expensive in information, not ceremony

At expiry, require:

  • current affected population, not the launch estimate;
  • usage and failure evidence by path;
  • named owner for the next interval;
  • a dated removal event;
  • the incremental cost of another renewal;
  • the condition that makes renewal unacceptable.

“Still needed” is not evidence. “Customer A will validate on August 8; remove after seven clean days” is.

Archive closed records rather than deleting them. The history answers whether teams repeatedly underestimate migration work or use exceptions to avoid product decisions.

Measure the portfolio

Track exception age distribution, renewals per exception, population trend, flags with no recent evaluation, and code paths eligible for deletion. Do not reward teams merely for low flag counts; that can encourage risky big-bang launches. Reward short evidence loops and completed cleanup.

Limits

This ledger fits behavior flags and temporary compatibility paths. It is not a substitute for incident controls, legal review, or safety mechanisms that must remain permanently available. Dollar estimates are conversation tools, not objective truth. Their value is exposing ownership and sensitivity.

The decisive question is not “How many flags do we have?” It is: what observed threshold would make this exception cheaper to remove than to renew?