Brownout
Deliberately reducing the quality or completeness of every response under load, rather than serving some requests fully and rejecting others.
The alternative to shedding: instead of a binary accept-or-reject, make each response cheaper. Everyone stays served; everyone gets slightly less.
Concrete mechanisms: skip the personalisation step and serve generic content, return 10 search results instead of 50, reduce image resolution, omit optional enrichment fields, lower the sampling rate on analytics, or answer from cache with a longer acceptable staleness.
It suits systems where a degraded answer is genuinely useful and a rejected request is not — consumer-facing read paths above all. It suits transactional operations poorly: a partially processed payment is not a degraded payment.
Two design requirements. The optional work must be separable, which means the code path has to be structured so enrichment can be skipped without touching the core — this is a design decision made long before the incident. And the system needs a control signal that turns brownout on and off, ideally automatically from a latency or queue-depth measurement, with a manual override.
Brownout and shedding compose: brown out first, shed only if that is not enough.