A permitting-classification endpoint is being updated to a new model version, and the rollout must shift traffic gradually while automatically reverting if the new version's error rate rises. Which deployment approach fits this requirement?
Select an answer to reveal the explanation.
Short Explanation
Rolling out a new model version all at once is like flipping every streetlight in the city to a new bulb type on the same night and hoping none of them are defective. A canary or linear rollout with deployment guardrails sends a small slice of traffic to the new version first, watches an error-rate alarm, and automatically pulls back to the known-good version if that alarm trips — no one has to be staring at a dashboard at the right moment.
Full Explanation
Traffic-shifting deployment strategies gradually move a defined percentage of live traffic to a new model variant — canary sends a small fixed slice first, linear increases it in steps — while an attached alarm on a metric like error rate continuously evaluates the new version's health; when deployment guardrails are configured, a breached alarm triggers an automatic rollback to the prior variant without waiting for a person to notice. Replacing the variant outright and relying on manual observation removes the gradual exposure that limits blast radius, and it depends on a human catching the problem in time, which is exactly the failure mode automated guardrails are built to eliminate. Routing all traffic to the new version immediately while leaving the old version idle offers no actual traffic-shifting or rollback mechanism — it's a full cutover dressed up to look safer than it is. Standing up a second endpoint and requiring manual client reconfiguration pushes the coordination problem onto every downstream consumer and still provides no automated health-based rollback. Scope caveat: the error-rate threshold on the alarm needs to be tuned against normal baseline noise, or the rollback can trigger on routine variance rather than a genuine regression. Operational check: intentionally deploy a version with a known defect in a test environment and confirm the alarm-triggered rollback actually reverts traffic to the prior variant.