Silent Pilot-to-Production Promotion

also known as Permanent Pilot, Pilot-in-Name-Only, The Pilot That Never Ended

Anti-pattern: let a well-performing pilot quietly expand in scope until it is a de facto production decision system, while keeping the 'pilot' label so it never trips the go-live governance gate.

Context

An organisation runs an agent as a limited pilot: a narrow user group, a low-stakes slice of traffic, a short list of decisions it is allowed to touch. The pilot performs well, so no one shuts it down or graduates it. Because it works, more teams ask to be added, more decision types are routed through it, and its outputs start to be acted on without review. The deployment grows continuously, but the paperwork still says 'pilot', and a pilot is exempt from the sign-off, risk assessment, and oversight that a production launch would require.

Problem

Go-live governance is triggered by a discrete event, the declared transition from trial to production, but a pilot that succeeds is never explicitly graduated, so that event never fires. Scope expands by small increments that each look too minor to warrant re-classification, and the cumulative result is a system making consequential production decisions under a label that exempts it from the very controls its real stakes demand. The gap between the formal status and the operational reality widens silently, and the longer it runs the more disruptive an honest re-classification becomes, so no one initiates it.

Forces

A successful pilot creates pull to widen its scope, but every increment is small enough to seem below the threshold that would require re-classification.
Declaring go-live triggers sign-off, risk assessment, and oversight that add friction, so keeping the 'pilot' label is the lower-effort path even as stakes rise.
The longer a mislabelled pilot runs, the larger the population that depends on it and the more disruptive an honest re-classification becomes, which discourages anyone from initiating it.

When to use

Recognise this anti-pattern when a pilot that performs well has no expiry and no exit criteria, so it simply keeps running.
Recognise it when scope grows by small increments, more users, more decision types, more direct action on outputs, each approved as a minor pilot tweak with no re-classification.
Recognise it when the formal status is still 'pilot' while the operational reality is a consequential production decision system that no go-live gate has ever scrutinised.

When not to use

The pilot is genuinely time-boxed with explicit exit criteria, and crossing a scope or stakes trigger forces a graduate-or-retire go-live decision through production governance.
The deployment is deliberately and reversibly limited in scope and stakes, so production-grade controls would be disproportionate and the 'pilot' label matches reality.
A formal go-live has already been declared, with a named production owner, risk assessment, and oversight in place commensurate with the live scope.

Example

A logistics firm pilots an agent that recommends which late shipments to escalate, on one regional desk, as advisory only. It works, so a second desk asks to join, then a third; soon every desk uses it and the recommendations are auto-actioned overnight without a human glancing at them. Twelve months on it is the firm's de facto escalation engine, but the change board still lists it as a 'pilot', so it never went through the production risk assessment, never got a named oncall, and never had a sign-off. The original Polish source names the dynamic exactly: 'pilotaz dziala dobrze, wiec nikt go nie wylacza, zakres zastosowania rozszerza sie po cichu (...) na poziomie formalnym wciaz mowimy o pilotazu, ale na poziomie faktycznym mamy produkcyjny system decyzyjny.'

Diagram

flowchart TD P[Pilot: narrow scope, advisory] -->|performs well| K[Kept running, never graduated] K -->|+ users, + decision types, outputs auto-actioned| E[Scope expands quietly] E --> R[De facto production decision system] R -.formal status still 'pilot'.-> G[Go-live governance gate never fires] G --> O[No sign-off, no named owner, no audit trail]

Solution

Therefore:

The anti-pattern is enacted by treating 'pilot' as an open-ended status rather than a time-boxed trial with an exit condition. A pilot that performs well is left running; new user groups and decision types are added one request at a time, each too small to seem to warrant re-classification; outputs that were once advisory begin to be acted on directly; and the formal status is never revisited, so the system grows into a production decision engine while still classified as an experiment exempt from go-live sign-off. The remedy is the inverse: scope every pilot with an explicit expiry and exit criteria, define objective triggers (user count, decision stakes, traffic share, irreversibility of outputs) that force a graduate-or-retire decision, and treat crossing any trigger as a go-live event that must clear production governance before the scope expansion is allowed to stand.

What it gives you

Short-term: a working pilot keeps delivering value without the friction and delay of a formal production sign-off.

What it costs you

A consequential decision system runs without the risk assessment, sign-off, and oversight that its real scope requires, because the label exempts it.
Scope creep is invisible to governance: each increment is logged as 'pilot expansion', so no review body ever sees a production launch to scrutinise.
Accountability is unowned, since a pilot has a trial owner and a feedback loop, not a named production owner answerable for live outcomes.
Honest re-classification becomes harder over time, because the larger the dependent population the more disruptive admitting production status is, which entrenches the mislabel.
When an incident occurs, the deployment is found to have been operating outside the controls that production status would have mandated, with no audit trail of a go-live decision.

What this pattern forbids. No useful constraint; the missing constraint is mandatory pilot expiry and graduation gating: a pilot must carry an explicit exit condition and objective re-classification triggers (scope, stakes, traffic, irreversibility) that force a graduate-or-retire go-live decision, and crossing any trigger forbids further scope expansion until production governance is cleared.

And the patterns that stand alongside it, or against it —

alternative-toDemo-to-Production Cliff✕— Anti-pattern: ship a demo-validated agent straight into production without a frozen eval, cost ceiling, loop-detector, or named oncall, then act surprised when accuracy drops and cost runs away.
complementsPerma-Beta✕— Anti-pattern: ship the agent in 'beta' indefinitely so that quality regressions are someone else's problem.
conflicts-withCompliance-Certified Launch Gate★— Require an external regulator to certify the generative service against a published content-safety standard before it may serve the public, forcing the standard's controls into the build as a re-certifiable artifact.
complementsAccountability Laundering via Algorithm✕— Anti-pattern: route a hard decision through an agent so no person owns the outcome, treating the recommendation as the decision while the firm's legal liability stays unchanged.

Neighbourhood

Click any neighbour to follow the language. Scroll to zoom, drag to pan.

References

Provenance

Source: patterns/silent-pilot-to-production-promotion.md on GitHub · view history
Added to catalog: 2026-06-14
Last updated: 2026-06-14
Contribute: open an issue or PR at github.com/agentpatternscatalog/patterns.