Service model and ownership
Map one user journey, dependencies, fallbacks, failure domains, owners, and support boundary. Start from user success, not host health alone.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
SLIs, SLOs, and error-budget policy
Write a versioned SLI specification with population, numerator, denominator, window, exclusions, data-quality owner, and review date. Use sample data to make a bounded release or reliability decision.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Alert policy and on-call readiness
Classify synthetic alerts as page, ticket, dashboard, or delete. A page must name the harm, owner, first safe check, runbook, minimum sample, and escalation condition.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Incident coordination and learning
Run a tabletop with an Incident Commander, operations lead, communications lead, UTC decision log, authorized mitigation boundary, stakeholder cadence, handoff, and owned learning actions.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Capacity models and safe load experiments
State workload assumptions, headroom, a bottleneck hypothesis, test scope, stop condition, and review date before a sandbox experiment. A simple queueing calculation is a model, not proof of saturation.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Deadline and retry budgets
Model a partial dependency failure with a total deadline, retry eligibility, fixed attempt limit, jitter, idempotency requirement, and fallback. Do not multiply work during overload without a user benefit.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Failure containment and graceful degradation
Design bulkheads, admission limits, staleness or fail-closed choices, load shedding, and recovery verification as separate controls. State which user journey is protected and what harm is accepted.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Cross-layer, falsifiable diagnosis
Use metrics for population impact, logs for discrete evidence, and traces for causal paths. Choose observations that could disprove competing hypotheses and keep sensitive attributes out of unsafe telemetry.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.
Toil reduction and reliability portfolio
Quantify repetitive work, then propose a dry-run or shadow-mode automation with least privilege, audit record, approval boundary, recovery path, owner, and before-and-after measure.
- •Start with an observable fact, then state what it does and does not establish.
- •Use a bounded, read-only exercise before recommending an authorized, reversible action.
- •Record the owner, decision boundary, and next update or escalation condition.