Phase 1: Pilot
Narrow use case, small user group, tight measurement. Clear hypothesis of value. Defined success criteria. Time-boxed (30-60 days). Kill criteria documented upfront.
Phase 2: Measure
Baseline before pilot. Track outcomes vs baseline during pilot. Verify hypothesis holds. Identify what worked and what didn’t. Honest assessment — don’t rationalize disappointing pilots.
Phase 3: Scale
If pilot passes, scale in stages. Monitor at each stage. Invest in change management, training, support. Expect friction; plan for it.
Phase 4: Govern
Ongoing oversight. Regression testing. Cost monitoring. Policy updates as threats evolve. Governance isn’t project phase; it’s permanent operating discipline.