A transit team stages security automation in detect-only mode for two weeks before enforce. What deployment approach is that?

A transit team that stages security automation in detect-only mode for two weeks before enforce is using a phased rollout: observe detections and would-be actions without committing isolation or other high-impact changes. Detect-only exposes false positives, missing context, and integration gaps against live bus, rail, and operations traffic while rider services keep running. After the shadow period proves signal quality and operator readiness, enforce can be promoted with far less risk of stranding vehicles or ops workstations.

Why the other options fail by concept: Using canary detect-only then enforce rollout for municipal security automation implies limiting initial exposure to a small canary subset before wider expansion, but the question describes a time-based phased staging of the automation in detect-only for two weeks before enforce with no canary subset mentioned. Using pilot detect-only then enforce rollout for municipal security automation implies trialing on a limited pilot group or site before broader rollout, but the question describes staging the same transit scope in detect-only for two weeks before promoting it to enforce, not a separate pilot trial. Using parallel detect-only then enforce rollout for municipal security automation implies running old and new approaches side by side at the same time, but the question describes sequential staging with two weeks in detect-only before enforce, not simultaneous parallel operation.

Exam caveat: Detect-only is a deployment phase, not a permanent substitute for enforcement; after metrics and false-positive rates are acceptable, the transit SOC must still promote enforce under change control. Operational check: run detect-only for the planned window, review alert volume and proposed actions with operations, document residual risks, then promote enforce only after sign-off and a ready rollback path.