B

Feature Console

Env

Heads up

Filters

A flag belongs to the GitLab project it is defined in — nothing is inferred.
A target is an organization when it matches a cloudResourceId and a person when it matches an email, the same test useFlag already makes.
Adding a target picks from DynamoDB. No free text, so a typo can't silently enable nothing.
Editing is gated on your GitLab role for that project. Reporter access is read-only — and GitLab enforces that itself, so this page greying out a button is a convenience, not the check.

A target that resolves to nothing enables nothing. Stale cloudResourceIds and addresses accumulate in flags; the notice bar at the top names any it finds, and the drawer marks them.
A user list can outlive the flags that used it. A list with no flag referencing it is invisible in this view — check GitLab's own user-list page when tidying up.
Editing a shared list changes every flag using it — the drawer says how many.

New project under beem/infrastructure, Terraform in-repo.
Deployed to the shared-services account at features.intranet.beemhq.com. That Route53 zone already exists and is owned by the corporate-vpn module in shared-services, so this repo reads it with a data source rather than creating it.
Same shape as beem-hosting: S3 + CloudFront + ACM + API Gateway + Lambda.
Sign-in is GitLab OAuth (PKCE). The token stays in this tab's memory and never reaches storage, so every change is made as you and lands in GitLab's own audit log.

B