Practice — Model Release Strategies: Canary, Shadow & Rollback (5 questions)

Your payments platform processes 50M transactions/day. The current fraud model declines 1.1% of transactions. A challenger trained on a new feature set shows a 6-point offline recall improvement. Fraud losses run into millions of dollars per percentage point of missed recall, and a false-positive decline directly angers a legitimate customer and can cause churn.

1. Design the full release sequence from "we have a promising challenger" to "fully promoted," naming each stage, its duration, and what you are trying to learn or de-risk at each one.
2. At the canary stage, decline rate on the challenger's traffic slice comes in at 1.35% against a pre-agreed guardrail band of [0.9%, 1.3%]. Is this an automatic-rollback condition or a human-gated one? Justify your answer and describe what the human (or automation) should check before deciding.
3. Explain specifically why shadow mode alone would have been insufficient to validate this release, even if it showed excellent agreement with the champion.