Make Risky Capabilities Opt-In

A feature flag is useful when it expresses a real security boundary. ‘Off by default’ should mean the route is unavailable, the provider is unreachable, or the capability cannot activate without an intentional configuration change.

For every opt-in surface, define who can enable it, what network targets are allowed, which credentials are used, and what evidence demonstrates that the restriction works.

Prefer a narrow allowlist and a fail-closed startup check over a permissive mode with a warning. Warnings are easy to ignore; an unavailable capability is much harder to misuse accidentally.