You maintain circuit breakers across 200 services. Configuration drift means half are misconfigured. What do you do?

What the interviewer is testing

Whether you recognise that the maintenance burden of a resilience mechanism is its real cost.

The diagnosis

Every circuit breaker configuration is a set of static numbers — pool size, timeout, error threshold, sleep window — and each is a guess that decays. Traffic grows, dependencies change, instance types change, and the thresholds that were correct last quarter now either trip on normal variance or fail to trip when needed.

Across 200 services and thousands of dependency pairs, nobody can keep them current. Half being wrong is the expected steady state, not a discipline failure.

And a drifted breaker is worse than none, because it trips during traffic spikes and causes the outage it exists to prevent.

The options

Retune them all, which fixes the symptom and recreates it within a year.

Standardise defaults derived from measured latency, generated per dependency from observed percentiles rather than chosen by hand, and regenerated on a schedule. Better, and still a batch process that lags reality.

Adaptive concurrency limits. Rather than configuring how many concurrent requests are allowed, the system measures latency continuously and infers the limit: when latency rises above the observed minimum, it is queueing, so reduce. When flat, allow growth. This is Little's Law as a control loop, borrowed from TCP congestion control.

Netflix took this route and placed Hystrix into maintenance mode. The system finds its own capacity and re-finds it whenever conditions change.

The trade-off to state

Adaptive limits are harder to explain during an incident — "why did we shed that request" has an answer derived from a moving measurement rather than a configured number. They need a clean latency signal and behave poorly on dependencies with bimodal latency.

For a small estate, hand-tuned static breakers remain entirely reasonable. The tuning burden is what tips the decision, and at 200 services it has tipped.

What a strong answer adds

The general principle: before adopting a resilience pattern, ask who maintains its configuration in two years. Any control requiring a human to keep a number correct across hundreds of services will drift, and the drift is invisible until it causes an incident.

Common weak answers

A configuration audit. Removing the breakers entirely.