Designing for Failure Domains

TL;DR

Assume failure. Isolate, degrade gracefully, and recover quickly.

Moves

• Circuit breakers and bulkheads
• Backpressure topologies
• Partition-aware design
• Graceful degradation

Checklist

• What is the worst credible failure? What breaks next?
• Does any request require multiple failure domains at once?
• Can we cut features to preserve core value under stress?