PostHog

Feature flag definitions and their variants, experiment exposure events, the event definitions the customer's metrics are built from, and the person and group properties a cohort is defined on.

Nothing on the first rung. Once the rung permits it, a flag variation and its allocation, created as a new flag or a new variant, never a change to a flag the customer's code already reads.

PostHog's own flag evaluation: a visitor is in the arm PostHog assigned them to, and Athren reads the exposure event PostHog records, so the arms Athren compares are the arms PostHog served.

The customer's own events, read from PostHog, joined to the exposure, and the downstream business metric defined in Athren: paid activation, upgrade, retention, with the window the experiment states.

A personal API key with read scope on projects, feature flags, insights and events. Everything on the first rung stays read-only; the write scope on feature flags is requested only when the rung that uses it is on, and the flag write is the only write.

The flag off, which makes the variant's code path unreachable; the change to the flag versioned in Athren with who approved it and when, so the revert can be read back later.