Multi-Region Change Management Lab

A browser-based training lab where you act as the change manager for a fictional freight forwarder with three regional stacks. Over three changes you classify the change, assess risk, choose approvers, plan testing, rollback, the window, communications and verification, and see a seeded outcome of what happened. It trains judgement about calendars, time zones and boundaries, not tool syntax.

Each region has its own freeze calendar, public holidays, time zone, on-call lead and sometimes data-residency rules. A window that is in business hours in one region is the middle of the night in another, and a rollback owned by one central team waits for that team to wake. A rollout in waves, with each region owning its own go and revert, handles this better than all regions at once.

Starting in a canary region lets you learn from real traffic before the other regions are touched. Report-only mode shows what would have been blocked, the soak period turns a finding into a fix, and each later region only starts when the previous one is clean. Doing all three at once makes one mistake a three-region outage.

Some data, such as personal data of customers in a region, must stay in that region under contract or policy. A change that forwards logs to another region has to be tested without moving the data, for example with a dry run and an egress diff, and needs the regional data protection officer to sign. Testing by sending real data across the boundary is itself the breach, and the lab penalises it.

A standard change is pre-authorised for its risk, not for the date. The default slot may fall on a public holiday in one region, inside a freeze, or on top of a carrier outage, and a hard certificate expiry leaves a deadline. A good plan checks each region's calendar and leaves margin before the expiry.

A revert that each region can run in its own hours, rehearsed before the window. In the WAF change that is a versioned policy with a one-step revert owned by the regional on-call lead. In the log change it includes a kill switch and a rehearsed deletion of anything that already arrived. A single global revert owned by one team is slower for the regions in the other time zones.

Each change hides a few risks, such as a legacy partner client, a field that leaks personal data or a certificate pinned by a partner. The seed fixes the dice. Tests, rollbacks, windows and approvers that address a risk make it much less likely to fire, and a good rollback or verification limits the damage if it does. The same seed, level and plan always give the same outcome.

Rookie shows a hint at each step and a "watch for" list of hidden dependencies, and has the lowest chance that an unmitigated risk fires. Pro hides the hints, but a good test plan reveals a hidden dependency as you choose it. Elite hides everything until the outcome and raises the chance that an unmitigated risk fires.

A Markdown change record per change, with type, risk, approvers, window, test, rollback, communications, verification, the simulated outcome and the process findings, and a CSV register of all three. Downloading and copying documents is Pro. You can read the same records on the debrief page.

No. Aldermoor Freight, its people, systems, calendars and the aldermoor.example domain are invented, the holiday and carrier maintenance are made up for the exercise, and every outcome is simulated in your browser. Nothing here connects to a real network.