Staged rollout

What it does

It limits how many people a fault can reach, and tests the system against real use before full reliance. Because no test anticipates everything real users do, the first weeks of production are treated as part of assurance. The system owner decides each expansion; engineering operates the mechanism at every new release and material change.

How to implement it

• Start with a small share of traffic, a single team or a pilot group.
• Run the new system alongside the old where possible and compare results.
• Define in advance the measures and thresholds for moving to the next stage.
• Monitor more closely than in steady state, including manual review of samples.
• Keep the ability to return to the previous version at once.
• Record the decision to expand, with the evidence.

Evidence it operates

Design: a rollout plan with stages, measures and exit criteria. Operation: records of each stage with the measures observed; a decision record for each expansion; an instance in which a rollout was paused or reversed.

Where it fits

Operates at deployment and for a defined period after. It supports model not fit for its intended purpose and inadequate pre-deployment testing by finding what earlier testing missed, and depends on drift and performance monitoring.

Limits

The pilot group may not represent the full population, so rare problems and problems for particular groups may not appear. People in the pilot are exposed to an unproven system and need the same protections as later users. A rollout that expands on a calendar and not on evidence is a staged launch in name only.