An insurer has three customer masters: one in the policy system, one in claims, one in the broker portal. Each is authoritative for something. Leadership wants one. Give the sequence that gets there without a cutover weekend.

The sequence, each step reversible

1. Build the match, publish nothing. Run matching across the three sources and produce a cross-reference table of "these records are believed to be the same person" with a confidence score. Change no system. This step is pure measurement and it is where the project's real difficulty becomes visible: typically 70–85% of records match with high confidence, and the remainder is the work.
2. Publish the cross-reference as a read-only service. Consumers who want a unified view can now join through it. Nothing has been mastered and nothing has been migrated, and several reporting problems are already solved — which buys the runway for the rest.
3. Declare authority per attribute, not per system. The policy system is authoritative for legal name, claims for correspondence address, the portal for contact preferences. Writing this down is the political centre of the project and it is a business decision, not an architecture one.
4. Build the golden record as a derived, non-authoritative view assembled by those rules. Let it run in parallel and be compared, not consumed.
5. Move consumers one at a time, read-only first. Each move is reversible: point the consumer back at its old source.
6. Move writes last, and only for attributes where authority has been settled. A write path to the master while three sources still accept edits is the state that produces irreconcilable divergence.

Where data can diverge, and how you would know

Divergence lives in the match, not in the fields. A false merge combines two people and is nearly invisible — the record simply has more history than it should — while a missed match leaves a duplicate that someone eventually notices. The two errors are not symmetric: a false merge can expose one customer's data to another, so the match threshold should be set to prefer duplicates over merges, and the review queue for the middle band is permanent staffing, not a project task.

The signal to run continuously: count of records above the merge threshold, count in the review band, and the rate at which reviewed decisions are later reversed.

The point of no return

Turning off a source system's own customer table. Before that, every step can be reversed by repointing a consumer. After it, reversal means reconstructing state that no longer exists anywhere.

How long it really takes

Longer than the plan, and the reason is stable across organisations: the attribute-authority decision requires agreement between teams whose incentives differ, and it cannot be made by the platform team. Assume the technical work is a quarter and the agreement is two.

When the whole programme is the wrong answer

If the three masters serve genuinely different purposes and the only shared need is reporting, the cross-reference from step 2 may be the entire solution. It is a fraction of the cost, it breaks nothing, and it fails safe. Master data management earns its cost when systems must write a consistent view, not when analysts must read one — and a surprising number of programmes discover after two years that they only ever needed the latter.