Make the release reversible and the operating plan concrete.
1. Feature controls
Use safe defaults, staged exposure and a kill switch. Validate remote configuration and preserve a useful manual or non-AI path.
2. Rollback scope
Prompt, model and application versions may need separate rollback. Keep compatibility between persisted results and older code when reverting behavior.
3. Incident playbook
Define signals, owners, mitigation and evidence collection. Exercise the playbook with a simulated provider outage or quality regression before relying on it.
Worked scenario
A model update increases invalid responses. Operators disable new inference while users continue editing existing documents manually.
Apply it
Run an outage drill and record detection time, mitigation steps and user-visible behavior.
Check your understanding
Another engineer can disable or roll back the feature from your documented procedure. Explain the decision and show evidence from your implementation or design. If you cannot demonstrate it yet, revisit the relevant section before continuing.