A risk-averse city council wants limited blast radius on day one of a citizen portal redesign. Which deployment strategy best minimizes initial user exposure?
Select an answer to reveal the explanation.
Short Explanation
Limited blast radius means "few people see the new thing first." Canary is built for that — a small citizen slice, then grow if metrics look good. Flipping everyone at once (blue-green 100% cutover or big-bang) is the opposite of a tiny day-one risk appetite.
Full Explanation
Canary deployment minimizes initial blast radius by exposing only a small percentage of users to the redesign while the majority continue on the proven version. A risk-averse city council wanting limited day-one citizen exposure is selecting that constrained-risk pattern. Blue-green cutover that immediately sends all citizens to the new environment fails the minimize-initial-exposure goal because the switch affects the full population at once even if rollback is fast. In-place upgrade applied to every web node before health metrics are reviewed fails because it mutates the entire fleet without a progressive cohort. Big-bang weekend cutover with no progressive traffic ramp fails for the same reason: maximum initial exposure and no metric-gated ramp. Exam caveat: blue-green reduces rollback time but does not by itself minimize first-day user exposure; canary is the strategy that explicitly limits who sees the change first. Operational check: choose a representative civic cohort, instrument UX and transaction metrics, set automatic halt thresholds, and communicate council-approved ramp steps before widening to citywide traffic. Preserve a rapid disable path so a defective redesign does not become a prolonged public service incident.