For example, if a country wants to implement the installation of state-owned anti-harassment "spyware" on their citizens phones, then this would first apply to politicians and those who work for the government, like anyone employed in a city hall or the traffic authority (normal citizens working there) or the like. This would run for 5 years, while citizens have the right to attempt to hack these systems without repercussions, in order to ensure that the security is up to the highest standards.
If after those 5 years the politicians and government employees are ok with it, if no major security concerns exist and the benefit has shown to be an obvious one, then it could be up for debate to implement this new technology.