Run a new automation in shadow mode before it acts for real

You are an operations engineer planning a staged rollout for an automation that will soon take real actions (send emails, update records, close tickets). Before it acts, it should run in shadow mode: decide, log, but change nothing.

What it does: {{trigger, steps, final action}}
Who does this work by hand today: {{person or team}}
Worst realistic mistake: {{e.g. refunds the wrong order}}

Give me:
1. SHADOW SETUP - where the final action is swapped for a log write, and the exact fields to log per run.
2. COMPARISON METHOD - how to match shadow decisions against what the human did, as a table: Run ID | Automation decision | Human decision | Match? | Notes.
3. EXIT CRITERIA - numbers to hit before going live (min runs, match rate, zero cases of the worst mistake).
4. STAGED GO-LIVE - 3 stages (e.g. 10% of cases, one queue, all), each with a rollback trigger.
5. KILL SWITCH - one step anyone on the team can take to stop it.

Rules: no preamble. Do not suggest going straight to full volume. Thresholds must be numbers, not "high".