A lending business must put one of four capabilities in its highest availability tier, which costs roughly £140k a year in redundancy and on-call. Onboarding takes about 900 applications a day across the working day. Disbursement runs once daily and must reach the payment rail before a 15:30 cut-off for same-day settlement. Which capability gets the tier?

The deciding property

Rank capabilities by whether the work can be done later without losing its value, not by how much traffic they carry. An outage in deferrable work moves the work; an outage in non-deferrable work destroys it.

Onboarding is deferrable. If it is down from 10:00 to 14:00, roughly 400 applicants are inconvenienced, some leave, and most come back or are recovered by an email. The queue drains afterwards, so the loss is a conversion dent, maybe a few percent of a day.

Disbursement is not deferrable, because an external clock runs independently of your system. A four-hour outage starting at 06:00 costs nothing. The same outage starting at 12:00 misses 15:30, and a day of lending settles a day late: interest accrues against the wrong date, customers who were promised same-day money do not get it, and in a regulated product that is a reportable service failure, not a bad morning.

What that changes in the build

The tier is not a label, it is a set of design obligations:

• Deferrable capabilities get a queue and replay. Accept the work, persist it, process when healthy. That is cheap and it converts an outage into a delay.
• Non-deferrable capabilities get redundancy ahead of the deadline and a manual path. A second rail connection, a tested file-based submission, and a run scheduled with enough slack that one full retry still lands before the cut-off. If the run starts at 15:10, the redundancy is decorative.
• Measure the window, once. The useful number is hours of slack between the earliest the work can be done and the moment its value expires. Disbursement here has about nine hours of slack and a hard wall; onboarding has days.

Why the other options fail

Onboarding because it carries the most traffic. Traffic measures how many people notice, not how much value is destroyed. This is the most common error in tiering, and it reliably over-protects the front door and under-protects the back office. It would be right if onboarding had its own clock, for example a regulated decision deadline.

The marketing site because it is the public front door. It is the cheapest thing to make highly available, which is why it should not consume the expensive tier: static hosting behind a CDN already gives you more nines than the lending core will ever have.

Internal reporting because executives depend on it. Reporting is the most deferrable capability in the business. A dashboard that is four hours late is a dashboard that is four hours late. Seniority of the audience is not criticality.

When this is the wrong answer

When a capability that looks deferrable has a hidden clock. Onboarding becomes non-deferrable the moment the business promises a decision inside a stated time, or a regulator sets one. The tier follows the promise, so re-run the ranking whenever commercial terms change, not whenever traffic does.