How do you roll out a risky backend change safely?

Decouple deploy from release with a feature flag, then ramp: internal users, a small percentage, then wider, watching error rate and latency against the control group at each step. Keep the old path intact so rollback is flipping a flag rather than redeploying, make the change backward compatible at the data layer, and set explicit criteria in advance for what makes you stop. Remove the flag once the rollout is complete.

The main idea is that deploying and releasing are different events. The code ships dark behind a flag, so the deploy itself is boring, then I turn it on for internal accounts first, then one percent, then ten, then the rest, pausing at each step long enough for the metrics to mean something. What I watch is error rate, latency and the business metric the change touches, compared against the users still on the old path, since a global graph can hide a regression that only affects the treated group. Any schema change follows expand and contract, so both code paths work against the same tables at every moment and I can flip back instantly, which is the entire point: rollback should be a flag change, not a redeploy under pressure. I write down beforehand what would make me stop, because at two in the morning nobody makes that call well. And the flag has an owner and a removal ticket, since a codebase with dozens of stale flags becomes impossible to reason about.