A commerce platform adopts the principle "every service must survive the failure of any single dependency". A team building an internal analytics dashboard requests an exemption. What does holding the line cost, and what does granting the exemption cost?
Show the full answer Hide the answer
Why the principle exists
For a platform whose merchants sell during flash sales and peak retail events, checkout must degrade rather than fail. A principle stated this bluntly removes the argument from every individual design review — it converts a per-case negotiation into a default.
The cost of holding the line
Applying it to an internal dashboard means caching, fallbacks and a degraded rendering mode for a tool used by a few hundred employees, whose failure costs a mildly annoyed analyst. Worse, it teaches engineers that the principle is performative — applied because it is written down rather than because it matters — which is how principles start being routed around quietly.
The cost of granting it
The exemption is cheap today and expensive as precedent, for one specific reason: internal tools migrate onto the critical path without anyone deciding they should. The dashboard gets an API. Support starts using it during incidents. A merchant-facing feature calls it "just for the count". Now a component built with an explicit exemption from the resilience principle sits in the serving path, and nobody re-ran the review.
The resolution better than both
State principles with scope and rationale, not as universals:
Principle: services on the merchant-facing critical path must survive the failure of any single dependency. Rationale: merchant revenue stops when checkout stops. Implication: a service moving onto the critical path must meet this before it does, and promotion onto that path is an architectural change requiring review.
Now the dashboard is out of scope by construction rather than by exemption, and the dangerous event — quiet promotion to critical — is what triggers review.
The judgement being tested
A principle without a rationale cannot be applied to a case its author did not foresee. A principle without scope will either be over-applied until it is resented, or exempted until it is meaningless.