Decision path
The six-question production decision
Answer in order. A ‘no’ does not mean abandon the product; it identifies the next kind of work. Evidence should be inspectable by someone other than the original builder.
- 01
Can a named owner explain the critical data flow?
If yesContinue to failure behavior.
If noMap inputs, storage, third parties and privilege boundaries before adding features.
- 02
Do failures preserve user data and allow recovery?
If yesContinue to security and privacy.
If noDesign timeouts, retries, idempotency, backups and user-visible recovery.
- 03
Are trust decisions enforced outside the browser?
If yesContinue to operational visibility.
If noMove authorization and privileged actions to controlled server boundaries.
- 04
Can the team detect a broken critical journey?
If yesContinue to change safety.
If noAdd meaningful logs, health signals and owned alerts.
- 05
Can a change be reviewed, tested and rolled back?
If yesContinue to legal and product obligations.
If noCreate release criteria, versioned changes and a rehearsed rollback path.
- 06
Are user promises, consent and data obligations accurate?
If yesA controlled production pilot may be justified.
If noResolve policy, retention, accessibility and contractual gaps first.
Choose exposure deliberately
Production is a series of scopes, not one dramatic switch
A private prototype can tolerate manual recovery and limited observability because the team controls every user. A public pilot cannot. The responsible move is often to constrain users, data types, permissions and transaction value while the operating evidence grows.
Avoid using ‘beta’ as a substitute for safeguards. A beta label can set expectations about polish, but it does not excuse losing customer data, exposing another account or making a claim the product cannot support.
- Define who may enter the pilot
- Exclude data the system is not ready to protect
- Publish the supported journeys and known limitations
- Name the condition that pauses or rolls back the release
Working sequence
A safer path from demo to dependable service
Each stage changes exposure only after its own evidence exists. The dates may move; the gates should not disappear.
Internal proof
- Map critical flows and dependencies
- Remove secrets and mock assumptions
- Create repeatable local and preview builds
Controlled pilot
- Limit users, data and permissions
- Monitor every critical journey
- Provide a direct support and recovery path
Public release
- Meet security, accessibility and legal criteria
- Operate alerts, backups and incident response
- Measure user outcomes and failure rates
Scale
- Load-test likely bottlenecks
- Review cost and vendor limits
- Assign long-term component and service owners
Applied example
Decision example: a feedback tool with real customers
The app authenticates users, stores private customer feedback and sends email. The happy path works, but no restore has been attempted, delivery failures are not visible and only the creator understands the database schema.
- The feature set is complete enough for a demo but the operating contract is incomplete.
- Private customer content raises the consequence of accidental exposure or loss.
- A small invite-only pilot could become reasonable after access tests, backup restoration, delivery monitoring and shared documentation pass.
- Opening unrestricted signup now would expand risk faster than operational knowledge.
Plain answers
Production-readiness questions
How much human review is enough?+
Enough that accountable owners can explain critical behavior, verify negative paths, operate failures and change the system safely. A fixed percentage of reviewed code does not establish that.
Can a low-risk landing page ship faster than an application?+
Yes. Exposure should follow assets and consequences. A brochure site and a multi-tenant portal need very different evidence.
Does using a mature framework make the app production-ready?+
It supplies useful primitives and guidance, but the application’s data flow, configuration, integrations and operations still determine readiness.