We want to roll out a risky change to 1% first—what’s the best way to ramp up gradually and stop immediately if errors spike?

Shipping a risky change doesn’t have to mean rolling the dice on your entire user base. You can start with 1%, ramp up in controlled steps, and automatically slam on the brakes the moment errors spike—all in production, no redeploys required.

Quick Answer: Use a feature flag with a progressive rollout and error-based guardrails. Start at 1%, define thresholds for errors or latency, and let an automated rollback or pause kick in the second things go out of bounds.

The Quick Overview

• What It Is: A runtime control pattern that uses feature flags, progressive rollouts, and automated guardrails to safely ramp risky changes from 1% to 100%—with instant kill switches if something breaks.
• Who It Is For: Engineering, SRE, and product teams who need to ship high-risk changes (architecture rewrites, pricing logic, AI behavior, etc.) without 2am fire drills or redeploy loops.
• Core Problem Solved: You want to test in production with real traffic while shrinking blast radius and guaranteeing you can stop or roll back immediately if error rates, timeouts, or other KPIs spike.

How It Works

You decouple the risky change from the deploy using a feature flag, then control exposure after deploy. Instead of a big-bang release, you drive a rollout timeline: start at 1%, validate, then ramp to 5%, 10%, 25%, and beyond. Under the hood, you’re continuously evaluating that flag at runtime via LaunchDarkly’s SDKs and observing impact on error rates, performance, and business metrics. Guardrails watch those signals and can automatically pause or roll back if things go sideways.

In practice, you move through three phases: Release, Observe, Iterate.

1. Release: Wrap the risky change in a flag and start at 1%.

   • Implement the change behind a LaunchDarkly feature flag.
   • Target just 1% of users (or a specific internal cohort) via percentage rollout or segment targeting.
   • Deploy safely knowing the flag is off for 99%+ of users.

2. Observe: Monitor metrics and enforce guardrails in real time.

   • Connect observability (errors, latency, key business events) to the flag rollout.
   • Define thresholds (e.g., error rate +0.5%, p95 latency +100ms).
   • Use Guarded Releases to automatically pause or roll back if thresholds are breached—no redeploy required.

3. Iterate: Ramp up gradually and clean up when stable.

   • Increase exposure in planned steps (1% → 5% → 10% → 25% → 50% → 100%).
   • Use policies and approvals for higher-risk ramps.
   • Once stable at 100%, schedule a TTL and clean up the flag to avoid debt.

Features & Benefits Breakdown

Core Feature	What It Does	Primary Benefit
Progressive Rollouts	Incrementally expose the risky change to 1%, then 5%, 10%, etc., using runtime percentage rollouts.	Limits blast radius and lets you validate behavior on real traffic before scaling up.
Guarded Releases & Kill Switches	Monitor metrics against thresholds and automatically pause or roll back the flag when errors or latency spike.	Stops incidents fast, without redeploys or waking the on‑call.
Targeting & Segmentation	Target internal testers, beta cohorts, specific regions, platforms, or customer tiers.	Lets you start with the safest, most observable users and ramp methodically.
Release Pipelines & Policies	Define standard rollout stages, approvals, and workflows for risky changes.	Makes “1% → full rollout” repeatable and governed across teams.
Real-Time Flag Updates	Push flag changes globally in <200ms via 25+ native SDKs.	Lets you ramp up or hit the kill switch instantly—even under load.
Observability & Experimentation	Tie errors, performance, and user impact directly to flag state, and optionally A/B test variants.	Shows exactly how the risky change affects reliability and behavior, no guesswork.

Ideal Use Cases

• Best for backend or infra rewrites: Because you can ship a new service path or database access pattern to 1% of calls, watch error/latency behavior, and auto-roll back if your thresholds are exceeded—before customers feel widespread pain.
• Best for high-risk business logic changes: Because you can guard things like billing, pricing, or authentication behind a progressive rollout and kill switch, ensuring that any mistake hits at most a small cohort and can be reversed instantly.
• Best for new AI behavior or agents: Because you can treat prompts, models, and agent graphs as runtime configs, progressively roll them out, and clamp down on problematic AI behavior without touching the codebase.

Limitations & Considerations

• You still need good observability: Automated rollback only works if you have solid metrics (error rates, latency, business KPIs) wired up. LaunchDarkly’s observability SDKs and integrations help, but you’ll want clean signals and alerting in place.
• Not a substitute for basic testing: Progressive delivery reduces blast radius, but it doesn’t replace unit tests, integration tests, or load testing. Use pre-production checks plus progressive rollout for the highest safety.
• Flag lifecycle requires discipline: Every risky rollout creates a flag. Without expiration dates and cleanup, flags can turn into technical debt. Use LaunchDarkly’s flag lifecycle tools (usage tracking, TTLs, archiving) to keep things tidy.

Pricing & Plans

LaunchDarkly is priced to support teams moving from “ad-hoc toggles” to standardized runtime control at scale.

• Team / Growth-style plans: Best for product and engineering teams that need robust feature flags, progressive rollouts, and kill switches for a growing set of services. Ideal if you’re formalizing safe rollout practices and want real-time control and basic governance.
• Enterprise plans: Best for larger organizations needing granular policies, custom roles, audit logs, enterprise SSO, AI Configs, experimentation, and observability—all under a single runtime control platform. Ideal when you want standardized “1% → 100%” rollout pipelines across many teams, with strong compliance requirements.

(For current pricing, tiers, and a tailored plan, talk to the LaunchDarkly team via the demo link below.)

Frequently Asked Questions

How do I technically set up a 1% rollout that can auto‑rollback if errors spike?

Short Answer: Wrap the risky change in a LaunchDarkly feature flag, configure a 1% progressive rollout, and attach Guarded Release rules that trigger an automatic pause or rollback when chosen metrics exceed thresholds.

Details:
At implementation time, you:

1. Create a feature flag for the risky change (e.g., risky_new_path).
2. Integrate an SDK (one of 25+ native SDKs) into your service so flag evaluation happens at runtime.
3. Wrap the new code path with a flag check:

   if (ldClient.variation("risky_new_path", user, false)) {
     // new behavior
   } else {
     // stable behavior
   }
   

4. Set a 1% rollout in the LaunchDarkly UI:
   • Rule: “All users” → 1% get true, 99% get false.
5. Define guardrails with Guarded Releases / Guardian:
   • Select metrics (e.g., error rate, p95 latency, failed-checkout count) from your observability stack.
   • Set thresholds (e.g., “if error rate increases by more than 0.5% compared to control over N minutes, auto-pause or rollback this flag”).
6. Start the rollout. LaunchDarkly evaluates the flag on every request and updates instantly worldwide (<200ms) if you change the rollout or if a guardrail triggers.

If error rates spike, the guardrail action (pause or rollback) fires automatically, reverting traffic to the stable path without redeploying. Your on-call gets notified, but they’re not scrambling to ship a hotfix.

What’s a safe ramp schedule from 1% to 100% for a risky change?

Short Answer: There’s no single “correct” schedule, but a common pattern is 1% → 5% → 10% → 25% → 50% → 100%, with guardrails at every step and extra soak time at low percentages for higher-risk changes.

Details:
I typically recommend planning a rollout like this:

• Stage 0 – Internal only:

  • Target staff accounts or a specific segment (e.g., employees, staging-like test accounts) at 100%.
  • Use this to catch obvious issues in production-like conditions.

• Stage 1 – 1% of real users:

  • Roll out to a random 1% of traffic or a safe, high-observability cohort.
  • Keep this running long enough to see a meaningful sample (often hours to a day, depending on traffic).
  • Watch error rate, latency, and key user actions.

• Stage 2 – 5% then 10%:

  • If metrics are clean, bump to 5%.
  • Let it soak, then move to 10%.
  • Guardrails stay the same; they’ll stop you if anything regresses.

• Stage 3 – 25% then 50%:

  • At this point, the change is seeing serious traffic.
  • You may require approvals via LaunchDarkly policies before moving between stages.
  • Consider longer soak times here, especially for changes that affect revenue or core flows.

• Stage 4 – 100% and cleanup:

  • Once you’re confident at 50%, promote to 100%.
  • Schedule flag cleanup: either convert the flag to a permanent control if it’s strategic, or remove it from code once fully stable.

Throughout, you’re not redeploying to change any of these percentages—just adjusting rollout rules at runtime. Every change propagates globally in under 200ms, which means you can respond to incidents immediately.

Summary

If you want to roll out a risky change to 1% first and ramp safely, you don’t need heroics—you need runtime control. With LaunchDarkly, you:

• Limit blast radius using feature flags and percentage rollouts.
• Watch the right signals via observability-integrated guardrails.
• React instantly with automated pauses or rollbacks and a manual kill switch, all without redeploys.

That’s how teams ship risky changes at speed and keep releases boring—even when the stakes are high.

Next Step

Get Started