Design the feature-flag service the rest of the company builds on. Services poll for their app's flag set on startup and every few seconds after, and an engineer occasionally flips a flag, sometimes at 3 a.m. to stop a launch that is going wrong.
The kill switch is the reason this service exists.