Glossary
Canary Deployment
A canary deployment releases a change to a small, limited subset of traffic or users before rolling it out to everyone, so that a problem with the change becomes visible on a bounded scale rather than being discovered only after it's already affecting the whole system. The technique is common for application code, and it applies just as directly to authorization policy changes, which carry the same risk of an unintended consequence that's much cheaper to catch small than to catch large.
For a policy change specifically, the canary subset needs to be chosen deliberately — broad enough to actually surface the categories of request the change might affect, not so narrow that a real problem simply doesn't happen to show up during the limited rollout.