Rollout, rollback, and exit

Treat model and prompt changes as releases with bounded exposure and a tested way back.

DIRECT ANSWER

Release AI changes behind a controlled boundary. Freeze representative tests, record versions, limit exposure, compare operating signals, preserve the prior path, and rehearse export and manual fallback before dependency becomes lock-in.

SYSTEM FLOW

Make every boundary visible.

01change
02evaluate
03flag
04canary
05compare
06rollback
07export

DESIGN DECISIONS

Three decisions carry the architecture.

Gate every material change

Re-run the evaluation set when model, prompt, source, permission, schema, or integration behavior changes.

Bound the canary

Limit users, data classes, volume, and duration with explicit stop conditions and a rollback owner.

Keep a portable record

Export configurations, prompts, test cases, decisions, and source ownership in a readable format.

FAILURE MODES

What breaks the boundary.

A vendor model alias changes behavior without a release record
Rollback restores code but not altered data
Exports omit the instructions and evidence needed to rebuild

VERIFICATION

Evidence before release.

Flag-off test
Data rollback rehearsal
Manual fallback timing
Independent export review