Service Level Objective Sheet
For each user-facing journey, the indicator, the target, the error budget it implies and what happens when the budget is spent.
An SLO without a consequence is a dashboard. This artifact's real content is the last column: what the organisation has agreed to do when the budget runs out.
The shape
| Journey | Indicator (SLI) | Target (SLO) | Window | Error budget | When budget is spent |
|---|---|---|---|---|---|
| Browse catalogue | Requests < 300 ms / valid requests | 99.0% | 28d rolling | 7 h 12 m | Prioritise a perf item next sprint |
| Submit order | Successful submits / attempts | 99.95% | 28d rolling | 21 m | Feature freeze; reliability work only |
| Submit order latency | Submits < 400 ms / submits | 99.0% | 28d rolling | 7 h 12 m | Perf item next sprint |
| Payment authorisation | Auths completed < 3 s / attempts | 99.9% | 28d rolling | 43 m | Freeze; incident review with provider |
| Order status freshness | Status < 60 s stale / reads | 99.5% | 28d rolling | 3 h 36 m | Pipeline work prioritised |
| Search | Results < 500 ms / queries | 98.0% | 28d rolling | 13 h 26 m | Track only; no freeze |
Contractual SLA: 99.9% monthly on order submit, service credits beyond. The internal SLO is deliberately stricter than the SLA, so the budget is exhausted before a customer is entitled to anything.
When you produce it
Once a service is live and has real measurements. Setting SLOs before you can measure produces numbers invented in a meeting. Review quarterly against actuals.
Who reads it
Product and engineering, who trade the budget between features and reliability. Executives, who accept that 99.95% costs something and 99.99% costs a great deal more. Operations, who alert on burn rate rather than on raw thresholds.
What good looks like
- SLIs are measured from the user's perspective — at the edge or by synthetic probe, not from a component's internal success counter.
- Every objective is per user journey, not per microservice. Users do not experience microservices.
- The error budget is stated in minutes, because a percentage does not feel like anything and twenty one minutes does.
- The consequence is agreed in advance and is real. If a freeze has never once happened, the SLO is decoration.
- SLO is stricter than any contractual SLA.
- Alerting is on burn rate, not on instantaneous breach.
Common mistakes
- A target of 99.99% chosen because it sounds serious, then missed every month until everyone ignores it.
- Per-component SLOs that are all green during a user-visible outage.
- No consequence, which makes the whole exercise reporting.
- Counting only errors, not latency. A slow response is a failed one past some threshold, and the threshold should be written down.