Plan the rollout

Plan the waves before the first machine is installed. The wave-1 list, the channel for waves 2 and 3, and the rollback owner are all answers from the prerequisites checklist; this page turns them into a schedule.

Three waves

Three waves of two weeks each, each one proving something the next depends on. Wave 1 proves the install and the key on real machines. Wave 2 proves your deployment tool. Wave 3 proves the perimeter. Never widen a wave until the one before it meets its exit criteria.

Every wave, the pilot included, enrolls with an organization key, so the people on the machines need no console account. Deploy the client holds the routes.

Attribute	Wave 1	Wave 2	Wave 3
Scope	About ten machines	About fifty machines	The full perimeter
Install route	Organization key, by hand on each machine or with a first recipe	Organization key, unattended through your deployment tool	Organization key, unattended through your deployment tool
Duration	Two weeks	Two weeks	Two weeks
Activity	Enroll each machine with the wave’s key, verify it, chase the agents still waiting on the person using them, and write down what people hit	Package the install, prove it on one machine of each operating system, then run it unattended and read the report it collects	Run the same package across the perimeter, and chase the machines that never report
Entry criteria	The organization is configured, and the wave’s organization key is created	Wave 1 met its exit criteria, and the recipe runs cleanly on one machine of each operating system	Your deployment tool is proven on every operating system in the estate, and the proxy scheme is confirmed on every subnet in scope
Exit criteria	Every enrolled machine reports to the console within 24 hours of install; the client’s own check reports no problem on each; no agent is left waiting on the person using it; the proxy route is confirmed on every operating system in the wave	The same four, plus every machine installed without a developer opening a terminal	The same four, plus the decision to run it as normal operations
Rollback	openlatch uninstall on the affected machine; the relay CA stays trusted unless you add --purge	The same, delivered through the tool that installed it	The same, delivered through the tool that installed it

Figure 1. Six weeks, three waves: what each one proves, and the gate between them.

Verify each machine and wave is how a machine, and then a wave, is proven against these criteria.

Effort and timing

Effort is front-loaded into the first week, when the organization is set up and the route is proven on one machine of each operating system in the fleet. After that, each wave repeats a procedure that already worked.

Phase of work	Wave 1	Wave 2	Wave 3	Typical effort
Prepare the console	Connect SAML, set allowed domains and audit retention, invite the rollout team, create the wave-1 organization key	Create the wave-2 organization key	Create the wave-3 organization key, and hand over the operating routine	A day in the first week, then a few hours a week
Prepare the network	Approve the egress entry and confirm the proxy route	Review the route through your deployment tool	No further change	Half a day in the first week
Prepare the machines	Prove the install on one machine per operating system, then enroll ten machines with the wave’s key	Carry the install in the channel you already operate and run the wave	Extend the same channel to the remaining machines	Minutes per machine after the first
Confirm and operate	Confirm each installed machine appears in the console’s agent record, with an owner where a directory is connected	Weekly checkpoint and a review of the deployment tool	Weekly checkpoint, then the decision to run it as normal operations	A weekly checkpoint through the rollout

One key per wave

Each wave enrolls with its own organization key, created from Host enrollment, so a key that has to be revoked affects one wave only. A machine needs the key only to enroll: it trades it for a host credential of its own, which keeps working after the key is revoked or rotated.

Moment	What to do with the key
Before the wave	As an admin or owner, create it under Settings › API keys from Host enrollment, name it after the wave, and store it in your secret store. It belongs to the organization, so it keeps working if you leave
During the wave	Deliver it to each machine as a key file, through --api-key-file or OPENLATCH_API_KEY_FILE, or as OPENLATCH_API_KEY in the environment the install runs in, never on a command line. openlatch init deletes a key file once the machine is enrolled
Before wave 1, optional	Trust your organization’s relay certificate machine-wide, and check one machine per operating system with openlatch doctor. Every wave then delivers the same bundle beside its own key
After the wave	Keep it only for the enrollments still to come. Enrolled machines that run the current client no longer use it; a machine on an earlier client authenticates with it until it updates
To retire it	Wait for the key’s last-used date to stop moving after the wave’s last enrollment, then delete it, which revokes it. Endpoint management that reruns the install on machines not yet enrolled needs a valid key for as long as it runs

Rollback

Name the rollback owner before wave 1: the person who can pause a wave and remove the client from a machine. Removal is openlatch uninstall, run on the machine or delivered through the tool that installed it, and it leaves each agent as it was. It keeps the relay CA, still trusted; add --purge to remove it. Uninstall covers removal in full.

In short

• Three waves of two weeks, all enrolled with an organization key: about ten machines, about fifty through your deployment tool, then the perimeter. Widen only once the previous wave meets its exit criteria.
• The first week carries most of the effort: the organization, the egress entry, and the install proven on one machine per operating system.
• One organization key per wave, created from Host enrollment. A machine needs it only to enroll; revoke it once the wave is enrolled on the current client.
• Name a rollback owner before wave 1. Removal is openlatch uninstall, per machine; the relay CA stays trusted unless you add --purge.