A feature flag is not an authorization check

Feature flags are great for rollouts. They are a poor substitute for authorization. A flag answers: “Is this code path on for this cohort?” An authz check answers: “Is this principal allowed to do thi