A 90-Day LangGraph Rollout Plan for Operations Leaders

Month three of an agent programme should produce a decision — one with evidence behind it that survives contact with someone who did not build it.

LangGraph in operations, a 10-part series. ← Part 9

The Rollout Order Is a Risk Classification, Not a Roadmap

Every decision is either a two-way door, reversed cheaply, decided now with the undo path written down, or a one-way door, decided late after the two-way doors have produced evidence. Teams that invert this spend month three defending a number instead of reporting one. The record schema, the mode gate ahead of each acting node, and shadow routing are two-way doors. Customer output, replacing a human approval queue, and moving a system of record are one-way doors.

Shadow Mode Is the Cheapest Test You Will Ever Run

Shadow mode means the graph runs, observes, decides, and does not act, logging and comparing its output against the current process. It cannot change an outcome, which is the point.

LangGraph does not ship a shadow mode; it is an orchestration runtime with durable execution, streaming, human-in-the-loop and persistence that runs standalone, and shadow mode is a mode you build from those primitives, not a product you buy. Each graph is its own compiled StateGraph with its own mode gate ahead of the acting node, so graphs advance from off to shadow to live independently.

A related saving is documented. Tradestack gave internal stakeholders access to the assistant during development and recorded their feedback in parallel with build work, saving two weeks of internal testing time. And the measurement loop produces the improvement, not the framework: New Computer ran structured experiments against a baseline memory implementation and reported 50% higher recall and 40% higher precision — deltas that exist because there was a harness to measure them.

A Migration That Reports Success Over an Empty Schema Is the Failure You Are Buying

LangGraph's persistent checkpointer, PostgresSaver, has a setup step that creates its tables and indexes, and the maintainers' own docstring says it must be called the first time the checkpointer is used (LangGraph persistence docs). A deploy that skipped it, or a migration runner that reports success without applying anything, is a failure someone has to look for rather than one that announces itself. The mitigation is an assertion: before running a per-service migration, check that the migration actually has something to apply, and after it, that the checkpoint tables exist, failing loudly when either does not hold.

Checkpoints also accumulate over long runs, so you need pruning or a retention policy (LangGraph persistence docs). Decide the retention window in month one, while the table is empty.

Land the Backbone in One Service and Copy It

Extracting a shared backbone before two services have shipped it produces a bespoke design per service. Land it in one service, then copy it. Shared pieces arrive as subgraphs that later graphs call as modules. Trellix is the public case study: several smaller LangGraph subgraphs first, then larger graphs that call the originals as modules. Airtop describes the same discipline from the micro end, starting with small capabilities so new ones could be added without redesigning control flow.

The Invoice Is a Checkpointer

LangGraph is a library and can run standalone inside a service you already operate (LangGraph overview). Run that way, the recurring cost is persistence: the checkpointer's setup step is a migration you own, and checkpoints accumulate over long runs (LangGraph persistence docs). That is the line item.

Sequence by Instrumentation, Not by Value

Put the agent where the money is. It is intuitive and it is the wrong ordering for the first quarter. The right axis is instrumentation. The service that already has shadow telemetry — where a change cannot alter an outcome — goes first, because a change there cannot alter an outcome.

So: the instrumented service first, and the valuable or irreversible ones only once it has produced evidence.

Put the Human at Three Points, Not Everywhere

When every node needs a signature, the human becomes a latency tax and stops reading.

Three points earn a gate, and only three. The mode gate ahead of the acting node: off, shadow or live, chosen per graph and per deploy. Before any write that cannot be undone. Before an answer leaves the building. LangGraph is built for human-in-the-loop oversight and for resuming a run from where it left off (LangGraph overview); the discipline is refusing to add a fourth.

Staff Answers Belong in Rows With an Actor, Not in Graph State

Graph state is a working set: versioned by checkpoints, pruned by retention, scoped to a thread, meaningless to anyone reading it six months later. A staff answer has an actor, a timestamp, a subject, and a reason. It needs to survive the checkpoint retention window, and the person who gave it leaving.

What I Would Actually Sign Off On

Four things get approved in month one, and they are all two-way doors. The record schema, with an actor column and a retention window, reviewed before the first checkpoint is written. The mode gate, built per graph ahead of the acting node, so a graph can be pulled back to shadow in a deploy rather than a project. The migration assertion — that the migration has something to apply, and that the checkpoint tables exist afterwards, failing loudly if not. And the shadow target: which service, which comparison, which owner reads the output.

Three things get deferred, and the deferral is the plan. Shared backbone extraction waits until two services have shipped it independently. Live acting waits for a clean comparison in shadow. Customer-visible output waits for a one-way-door review with an undo path someone has actually written down. One thing gets measured weekly, and it is not accuracy: the count of graphs in each mode, and whether that count moved for a reason.

The One Page You Owe Before the Quarter Ends

The ask is one page, one line per graph, naming the mode it is in today and the record it leaves. Not the architecture, not the prompts, not the benchmark score. That page is hard to produce if the quarter was sequenced as a feature programme, because nobody knows the modes as a set. It makes the quarter's output falsifiable: a graph in shadow with an empty checkpoint table is visible on it, a graph in live with no actor on its decisions is visible on it, and a graph that moved from shadow to live because of a number somebody liked rather than a comparison somebody ran is visible on it.

Ninety days is not enough time to know whether an agent works. It is more than enough time to know whether you can say what happened — and that is the decision the quarter is actually for.