A rollout reaches 80%, but one customer remains on the old path. The exception enters a spreadsheet as “temporary.” Six months later, nobody knows who approved it, which metric justified it, or whether removing the old path would break a contract.
The flag is no longer reducing launch risk. It is financing two products indefinitely.
A useful exception is a time-bounded decision with evidence. Use a ledger whose minimum record is:
exception: legacy-export-path
owner: platform-pm
population: enterprise-plan AND export_v1_contract
created: 2026-07-23
expires: 2026-08-20
reason: two customers need signed migration plans
evidence:
population_count: 2
weekly_uses: 14
incidents_30d: 0
removal:
engineering_days: 3
customer_work: rotate integration endpoint
stop_rule: renew only with named customers and dated migration events
Price the exception as a decision
Do not reduce cost to flag-service fees. A simple monthly estimate is:
exception cost = maintenance
+ duplicate testing
+ incident ambiguity
+ support handling
+ delayed deletion
Worked example:
| Cost | Hours/month | Loaded rate | Monthly |
|---|---|---|---|
| Regression coverage | 6 | $100 | $600 |
| Support diagnosis | 4 | $90 | $360 |
| Release coordination | 3 | $110 | $330 |
| Expected incident work | 2 | $130 | $260 |
| Total | 15 | — | $1,550 |
These are illustrative inputs, not a benchmark. Replace them with observed hours. At two customers, the visible carrying cost is $775/customer/month, before opportunity cost.
Use hard gates before arithmetic
A weighted score can create false precision. Check non-negotiable gates first:
Safety: does removing the exception create data loss or an unauthorized action?
Contract: is behavior contractually committed through a known date?
Observability: can the team identify every affected request and customer?
Reversibility: is there a tested rollback after removal?
A failed safety or observability gate blocks deletion. A failed ownership gate blocks renewal.
Then compare three options:
| Option | One-time cost | Monthly cost | Risk |
|---|---|---|---|
| Renew 30 days | $0 | $1,550 | divergence grows |
| Migrate both customers | $4,500 | $0 after removal | coordinated change |
| Productize both paths | $12,000 | $900 | permanent complexity |
If migration costs $4,500 and renewal costs $1,550 monthly, the simple break-even is about 2.9 months. Vary the uncertain inputs:
| Monthly carrying cost | Break-even |
|---|---|
| $800 | 5.6 months |
| $1,550 | 2.9 months |
| $2,400 | 1.9 months |
The model does not choose. It reveals which assumption reverses the choice.
Make renewal expensive in information, not ceremony
At expiry, require:
- current affected population, not the launch estimate;
- usage and failure evidence by path;
- named owner for the next interval;
- a dated removal event;
- the incremental cost of another renewal;
- the condition that makes renewal unacceptable.
“Still needed” is not evidence. “Customer A will validate on August 8; remove after seven clean days” is.
Archive closed records rather than deleting them. The history answers whether teams repeatedly underestimate migration work or use exceptions to avoid product decisions.
Measure the portfolio
Track exception age distribution, renewals per exception, population trend, flags with no recent evaluation, and code paths eligible for deletion. Do not reward teams merely for low flag counts; that can encourage risky big-bang launches. Reward short evidence loops and completed cleanup.
Limits
This ledger fits behavior flags and temporary compatibility paths. It is not a substitute for incident controls, legal review, or safety mechanisms that must remain permanently available. Dollar estimates are conversation tools, not objective truth. Their value is exposing ownership and sensitivity.
The decisive question is not “How many flags do we have?” It is: what observed threshold would make this exception cheaper to remove than to renew?
SOCIAL SHARE CARD GENERATOR