Design the feature-flag service the rest of the company builds on. Every service polls for its app's flag set on startup and every few seconds after; an engineer occasionally flips a flag — sometimes to launch something, sometimes at 3 a.m. to stop a launch that is going wrong.
Nothing about the load will impress anyone: a modest stream of reads, almost all of them for the same handful of flag sets, and on a busy day one write per second. The contract is where the problem lives. A flipped kill switch must never quietly unflip, so the ack the dashboard shows has to mean every promised copy agrees — and the service must keep answering through a dead node and through a dark availability zone, because a flag service that is down freezes every deploy in the company.
The grade is normalized against a reference that spends almost nothing. Honor the whole contract — the durable flip, redundancy on every serving tier, the thirty-second staleness bound — and then stop spending.