Your team ships a globally distributed web application through a single Azure Pipelines multi-stage deployment. Leadership wants to reduce the blast radius of a bad release by rolling changes out first to internal employees, then to a small group of early-adopter customers, and finally to all production users — with a mandatory validation window and telemetry review before each broader wave. Which deployment strategy should you implement to satisfy this requirement?