Progressive delivery
A pilot cohort does not change the access rules
Feature targeting controls exposure, not authority. The candidate must enforce the same data boundaries as the stable service.
In this article
Keep cohort membership separate from permission
A user selected for a pilot may still lack access to a particular record or operation. Check normal authorisation after the exposure decision.
Do not use a feature flag as a substitute for role enforcement. Flags often have different owners, interfaces and lifecycle rules from access policy.
Test a pilot user attempting an action they are not allowed to perform and a non-pilot user requesting the candidate endpoint directly.
Review targeting data
Decide which identifiers are necessary to assign a stable cohort. Avoid sending unnecessary personal details to a flag or experimentation service.
Inspect telemetry labels and diagnostic output. Cohort analysis can become a new copy of user attributes if the implementation logs its entire evaluation context.
Keep operator access to targeting controls appropriate to their effect. Enabling a sensitive capability for everyone can be a consequential production change even without a new deployment.
Prevent candidate data leakage
The candidate may add fields, logs or traces that the stable application does not produce. Review those outputs under the same data policy.
For an illustrative AI feature, pilot prompts and retrieved documents should not be copied into broad release dashboards merely to help compare quality. Use controlled evaluation records and appropriately scoped diagnostics.
Verify cross-tenant access and error responses in both versions. A limited cohort reduces exposure but does not make a disclosure acceptable.
Remove temporary access after the trial
Pilot support may require temporary diagnostic privileges. Record their purpose and removal condition, then verify cleanup after the rollout or abort.
Review dormant flags and candidate endpoints that remain deployed. Disabled navigation does not necessarily prevent direct access.
The release review should establish that exposure can be controlled without weakening authority or creating unnecessary data copies. A successful pilot includes the users who should be denied, not only those invited to try the feature.
Primary sources
OWASP: authorisation guidanceReferences checked 11 September 2026.