The Real-Tenant Probe
Move the moment of truth forward. Before deep planning, run a two-day probe against a real tenant — and let it cancel the PRD if the foundation isn't there. Cancellation is a successful outcome.
I — Where this comes from
The Pipeline Is a Partnership named the rule: autonomous within a phase, hard checkpoint between phases, with the real tenant as the gate that catches what mocks cannot. That essay fixed when the tenant runs the verdict — between phases of a build.
This essay fixes one phase earlier.
The Redirect Manager build forced the question. PRD-000 (English-only redirect maps) shipped clean. PRD-001 planned the multilingual extension: per-language redirect maps, locale-prefixed source URLs, fallback semantics, the whole shape. The architecture was credible. The task breakdown was credible. The mocks were credible.
Two days into Tranche 1, a real-tenant capture against the stock Sitecore
Redirect Map template returned a single inconvenient fact: the
UrlMapping field — the one PRD-001 needed to scope per-language — is SHARED
on the stock template. Not Versioned. Not Unversioned-per-language. Shared.
One value, all languages, no override path that doesn't replace the template.
PRD-001 was cancelled at Tranche 1. Two days spent. Two-to-four weeks saved.
That cancellation is the methodology.
II — The shape of the probe
A real-tenant probe is a short, scripted spike that runs before the architecture-and-tasks expansion, against the single load-bearing assumption the PRD is built on. It has a fixed shape.
The probe earns the right to cancel by being cheap on entry. If a probe takes two weeks, it has the same blast radius as the build it's meant to de-risk, and cancellation becomes politically expensive — operators won't walk away from sunk cost on a fortnight's spike. Two days is the limit that keeps the cancellation lever functional.
III — What it caught
Two products ran the probe in 2026-Q2. Both got an answer they couldn't have predicted from the SDK type definitions or the prior runs.
IV — The contract
Four rules, deliberately small. The probe survives because it stays a spike, not a build.
| Rule | What it means |
|---|---|
| Two-day cap | The probe lives in Tranche 1 and exits in 48 working hours. If it can't be answered in two days, the assumption is too coarse — split it before probing. |
| One assumption, named | The PRD declares the single load-bearing assumption up front. The probe targets that one. Probing four assumptions is a build, not a spike. |
| Three legitimate outcomes | Green / yellow / red, with red as a clean exit. A probe that always returns green isn't a probe — it's a confirmation ritual. |
| The capture is the artefact | Whatever the verdict, the probe leaves behind a captured shape: a real GraphQL response, a real SDK return value, a field-versioning matrix. That capture outlives the PRD it killed or shipped. |
The fourth rule is the one that turns a cancelled PRD into a long-term asset. Redirect Manager PRD-001 left a field-versioning matrix that documents the stock template's constraints; any future Sitecore Redirect Map work starts from that document instead of re-discovering the limitation. Paywall PRD-000 left a captured identity table that seat-aware PRD-002 will inherit. The probe never costs nothing — even on a red verdict it produces a reference artefact.
V — Why it works
There are two reasons.
Cancellation has to be cheap. A PRD that took two weeks to plan cannot be cancelled lightly — operators rationalise, scope down, ship the half that works. A PRD that's been probed for two days can be cancelled. The asymmetry is the lever. Move the load-bearing question to before deep planning and cancellation stays in the operator's toolkit for as long as it needs to.
The right artefact is a captured shape, not a memo. Probes that end in prose-only conclusions ("we tried and it doesn't seem to work") get re-litigated six months later. Probes that end in a captured GraphQL response, a captured SDK return value, a field-versioning matrix, do not. The next operator opens the artefact, reads the shape, and either accepts the prior verdict or finds a new question. The artefact is the spec for the next conversation.
VI — Hooks for the next round
Move the moment of truth forward.
The hard checkpoint between phases catches integration bugs. The probe at Tranche 1 catches assumption bugs. Same idea, one phase earlier.
Cancellation is a successful outcome.
Two days spent, two-to-four weeks saved. A probe that never cancels anything isn’t doing its job — it’s a confirmation ritual with a different name.
Name the load-bearing assumption.
Every PRD has one assumption the whole feature pivots on. Probing four is a build. Probing one in two days is a spike. The discipline is finding the right one before you start.
The capture is the artefact.
Whatever the verdict, leave behind a real shape — a GraphQL response, an SDK return value, a versioning matrix. That artefact outlives the PRD and trains the next decision.
Two days is the lever.
If a probe takes two weeks, it has the same blast radius as the build it’s de-risking, and cancellation becomes politically expensive. The two-day cap is what keeps the cancellation lever functional.
The pipeline still runs the build. The dogfood loop still hardens the skills. The partnership still owns the gate between phases. The probe sits one move earlier on the board — the cheapest, sharpest question you can ask a tenant before committing to plan against it.
Related case studies
