Crawl, Walk, Run Is Sometimes a Lie

The phase model is the default because it’s easy to sell

Crawl, walk, run is the safest thing a product leader can say in a planning meeting, and safety is exactly the problem. Sequenced rollout is right when phases share a mechanism and actively harmful when they don’t, and most teams apply it by default without checking which case they’re in.

The appeal is real. A phased plan is legible to everyone in the room. The finance partner sees a small bet before a large one. The engineering lead sees a scoped first milestone. The executive sees de-risking. You ask for a fraction of the budget, prove something with it, and earn the rest. This is the standard advice in the Reforge and First Round canon, and for most launches it’s correct. Ship the manual version, learn, then automate. Ship one market, learn, then expand. Ship the read path, then the write path.

It’s correct because most products have continuous physics. The thing that makes the small version work is the same thing that makes the large version work. A concierge MVP that delights 20 users tells you something true about the product that will delight 20,000. The mechanism scales even when the numbers don’t. When that holds, the crawl is a discount on certainty and you should take it.

The failure case is when the crawl has different physics than the run

The model breaks when the small version and the large version run on different mechanisms. Then the crawl doesn’t de-risk the run. It manufactures confidence in the wrong direction.

AI-native products are the clearest category where this happens. Consider a support agent meant to resolve tickets end to end. The crawl version is a suggestion tool: it drafts a reply, a human reviews it, the human sends. The run version is autonomous: the agent reads, decides, and acts without a human in the loop. These look like phases of one product, but they are two different products with two different failure modes.

The suggestion tool fails softly. A bad draft gets caught by the reviewer, edited, and sent. You measure acceptance rate, you see roughly 70 percent, and you conclude the model is good enough to trust further. But the reviewer was the safety mechanism, and the run version deletes that mechanism. The autonomous agent fails hard: it acts on the same bad output the reviewer would have caught, and there’s no catch. The crawl’s success rate told you nothing about the run’s failure rate, because the thing keeping the crawl safe doesn’t exist in the run.

This is the trap. The crawl produced evidence. The evidence was confident. And the evidence was about a system that no longer exists once you remove the human. You didn’t de-risk the run. You spent a quarter proving a hypothesis about a different product and stapled the conclusion to this one.

The same pattern shows up anywhere a small deployment carries a human, a manual override, or a forgiving load that the full version removes. Recommendation systems where the crawl runs on curated inventory and the run faces the long tail. Fraud models tuned on a friendly cohort and shipped against adversaries who adapt. Pricing engines validated in a market with no competitive response and deployed into one that reacts.

The discriminator is one question about failure modes

You don’t need a framework to tell the two cases apart. You need one question: does the small version’s failure mode predict the large version’s failure mode?

If the answer is yes, phase it. The concierge MVP fails when users don’t want the outcome, and the scaled product fails the same way. Same mechanism, same failure, cheaper test. Take the discount.

If the answer is no, the phase plan is worse than no plan, because it will hand you evidence you’ll believe. Ask what makes the crawl version safe or successful, then ask whether that thing survives into the run. If a human reviewer, a curated dataset, a captive cohort, or an unreactive market is doing the load-bearing work, the crawl’s physics don’t match the run’s, and its results don’t transfer.

The question is diagnostic, not directional. It doesn’t tell you to go faster or slower. It tells you whether the cheap evidence you’re about to collect is worth anything.

The fix is building the smallest version with the right physics

The answer to a broken crawl is not to skip validation and ship the autonomous version on day one. That’s how you learn about the hard failure mode in production, which is the most expensive classroom there is.

The answer is to build the smallest version that has the right physics. For the support agent, that means a small autonomous deployment with no human in the loop, on a narrow slice of tickets, with tight monitoring and a real rollback. It’s autonomous where the run is autonomous. It fails the way the run fails. It’s small in scope but honest in mechanism.

This version is almost always more expensive than the fake crawl and less legible in the planning meeting. You can’t say “we’ll have a human check everything at first.” You have to say “we’re going live without a safety net on a small surface, and we’ve built the monitoring to survive that.” That’s a harder ask. It’s also the only ask that produces evidence you can trust. The extra cost buys you the one thing the cheap crawl couldn’t: a failure that means something.

The burden is on demonstrating different physics

The obvious objection is that this becomes a license to skip validation. Any team that wants to avoid the discipline of a phased rollout can declare their case special, invoke “different physics,” and ship the ambitious version untested.

That objection holds only if “different physics” is something you can assert. It isn’t. The burden is on demonstrating it, and the demonstration is specific: name the mechanism that makes the crawl safe, and show that it’s absent in the run. If you can’t name the load-bearing element that disappears, you haven’t found different physics. You’ve found an excuse, and the default applies. Phase it.

Most teams, run through this test, will find their crawl and their run share a mechanism. The phase model survives for them, and it should. This memo doesn’t retire crawl, walk, run. It gives the phrase a precondition. Sequence when the small version fails the way the large one will. When the mechanisms diverge, the crawl isn’t a smaller step toward the run at all. It’s a confident measurement of the wrong thing.