Decision guide
Feature flags control rollout. Entitlements control customer access.
A customer can have access to a feature before you finish rolling it out. Your application may need to check both the entitlement and the feature flag before allowing it.
By Jasen Fici · Updated August 22, 2026
| Dimension | Feature flag | Entitlement |
|---|---|---|
| Question | Is this code path released or operationally enabled for the operation? | Is this customer allowed to use the capability, and at what value or limit? |
| Primary actor | Engineering, product, or experimentation teams | Product operations, sales policy, contracts, and customer success |
| Lifecycle | Often temporary for rollout, experiments, or incident control | Lives with the commercial agreement and customer assignment |
| Where the answer comes from | Release and experiment configuration | Plan, package, purchase, contract, or explicit grant |
| Value shape | Boolean or variation, depending on the flag system | Toggle access, numeric limit, or text value |
| Audit question | Who changed rollout, targeting, or a kill switch? | Why did this customer receive or lose access? |
| Common failure | Stale rollout state or provider/cache outage | Incorrect commercial mapping, effective date, or override |
Use both
The account needs the entitlement and the release flag.
Acme bought Advanced Reporting. That makes the account eligible. The new report engine is at 20 percent rollout. Both decisions must be true before the application uses the new implementation.
Keep separate names so logs can explain which condition denied the operation.
const entitled = await subscrio.featureChecker.isEnabledForCustomer(
account.key, 'analytics', 'advanced-reporting'
);
const rolledOut = await flags.isEnabled('new-report-engine', {
accountId: account.key
});
if (!entitled || !rolledOut) {
throw forbidden({ entitled, rolledOut });
}Why plan-targeted flags stop working
A plan name cannot carry the full commercial agreement.
Targeting Pro and Enterprise can work for the first release. Then sales grants 40 seats to one Growth customer, a legacy package keeps an old feature, and a downgrade waits until the end of the period. The permanent model needs values, dates, and explicit customer exceptions.
- LaunchA flag targets Pro while the feature is being released.
- Packaging growsGrowth and Enterprise receive the feature at different limits.
- Contracts divergeAcme receives a customer-specific seat limit and a delayed downgrade.
- Use both systemsThe entitlement decides whether the customer receives the feature and at what value. The flag controls the rollout.
Decision guide
Use flags for rollout and entitlements for customer access.
Rollout controls change with releases, experiments, and incidents. Entitlements change with plans, packages, purchases, grants, and customer agreements. These examples show where each rule belongs.
Keep it in the flag system
- Percentage rollout.
- Beta cohort.
- Kill switch.
- A/B variation.
- Temporary operational targeting.
Put it in the entitlement model
- Feature included in a plan or package.
- Seat, project, storage, or API limit.
- Customer contract exception.
- Purchased module or add-on.
- Access tied to assignment dates or subscription state.
Continue with the entitlement data model or implement the check with the .NET or TypeScript library.
Common questions
Questions about feature flags and entitlements
What is the difference between feature flags and entitlements?
Feature flags control whether code is released or operationally enabled. Entitlements determine whether a customer can use a feature, usually based on a plan, purchase, contract, or grant. A product may require both checks. The customer must have the entitlement and the feature flag must be enabled.
Are feature flags the same as feature gating?
No. Feature gating is the decision that controls whether code may run. A feature flag can supply a rollout condition, while an entitlement can supply the customer-access condition. One gate may require both.
Can feature flags be used for subscription plans?
They can target plan attributes, but a permanent commercial model becomes difficult when you add numeric limits, customer-specific contracts, scheduled changes, and more than one source of access.
Should entitlements replace feature flags?
No. Keep flags for rollout, experiments, kill switches, and operational control. Use entitlements for customer access derived from plans, purchases, and grants.
Which check should run first?
Run both before the protected action. Many teams check the entitlement first to avoid evaluating rollout for an ineligible account, but the correct order can depend on logging and flag-provider behavior.
Next step
Keep rollout and customer feature access separate in code.
Name the entitlement feature and rollout flag independently, then require both before the protected behavior runs.