Governance Artifact run intermediate

Service Level Objective Sheet

For each user-facing journey, the indicator, the target, the error budget it implies and what happens when the budget is spent.

An SLO without a consequence is a dashboard. This artifact's real content is the last column: what the organisation has agreed to do when the budget runs out.

The shape

Journey Indicator (SLI) Target (SLO) Window Error budget When budget is spent
Browse catalogue Requests < 300 ms / valid requests 99.0% 28d rolling 7 h 12 m Prioritise a perf item next sprint
Submit order Successful submits / attempts 99.95% 28d rolling 21 m Feature freeze; reliability work only
Submit order latency Submits < 400 ms / submits 99.0% 28d rolling 7 h 12 m Perf item next sprint
Payment authorisation Auths completed < 3 s / attempts 99.9% 28d rolling 43 m Freeze; incident review with provider
Order status freshness Status < 60 s stale / reads 99.5% 28d rolling 3 h 36 m Pipeline work prioritised
Search Results < 500 ms / queries 98.0% 28d rolling 13 h 26 m Track only; no freeze

Contractual SLA: 99.9% monthly on order submit, service credits beyond. The internal SLO is deliberately stricter than the SLA, so the budget is exhausted before a customer is entitled to anything.

When you produce it

Once a service is live and has real measurements. Setting SLOs before you can measure produces numbers invented in a meeting. Review quarterly against actuals.

Who reads it

Product and engineering, who trade the budget between features and reliability. Executives, who accept that 99.95% costs something and 99.99% costs a great deal more. Operations, who alert on burn rate rather than on raw thresholds.

What good looks like

  • SLIs are measured from the user's perspective — at the edge or by synthetic probe, not from a component's internal success counter.
  • Every objective is per user journey, not per microservice. Users do not experience microservices.
  • The error budget is stated in minutes, because a percentage does not feel like anything and twenty one minutes does.
  • The consequence is agreed in advance and is real. If a freeze has never once happened, the SLO is decoration.
  • SLO is stricter than any contractual SLA.
  • Alerting is on burn rate, not on instantaneous breach.

Common mistakes

  • A target of 99.99% chosen because it sounds serious, then missed every month until everyone ignores it.
  • Per-component SLOs that are all green during a user-visible outage.
  • No consequence, which makes the whole exercise reporting.
  • Counting only errors, not latency. A slow response is a failed one past some threshold, and the threshold should be written down.