Protocol
Define the cheaper mode that preserves the core function
Degraded and useful beats complete and unavailable.
When it fits
- Demand spikes or a dependency fails and the full service cannot be delivered reliably.
When to avoid it
- A complex rarely tested fallback can be less reliable than the main path; keep degradation simple and exercise it.
Why it matters
Identify the smallest core outcome users still need under stress, then define a simpler mode that costs less or uses fewer dependencies. Test that path before an incident. Make degradation visible so users know which features or freshness they lost.
Steps
- The degraded mode continues to deliver the central value with measurably lower resource or dependency demand.
An example
During model-provider overload, return cached reference data and disable expensive enrichment instead of failing the entire workflow.
Check your result
The degraded mode continues to deliver the central value with measurably lower resource or dependency demand.
Keep this limit in mind
- A complex rarely tested fallback can be less reliable than the main path; keep degradation simple and exercise it.
Evidence and sources
Supports
Google and AWS overload guidance recommend load shedding or graceful degradation to preserve core useful work when total demand exceeds available capacity.
Which work may be dropped or degraded is a product and safety decision, not only a technical one.
Addressing Cascading Failures · Load shedding and graceful degradation