Complexity Budget
The idea that an organisation can operate only a bounded amount of complexity, so each resilience mechanism must justify its share.
Every reliability mechanism adds something to operate and something that can fail: a circuit breaker with thresholds that can be wrong, a multi-region topology with replication and failover, a retry policy that can amplify load, an autoscaler that can scale the wrong way.
More machinery does not monotonically increase availability. Past a point it decreases it, because the machinery becomes the failure. Automated failover that triggers on a network partition, retries that turn a blip into an outage, and an autoscaler that removes capacity during a traffic dip are all cases of protection causing the incident.
The budget framing: the organisation can operate a bounded amount of complexity well, and each mechanism spends part of it. The questions for any proposed addition are what failure it addresses, whether that failure has actually occurred, what it costs to operate and test, and what happens when the mechanism itself misbehaves.
Simplicity is a reliability property. A system a new engineer can understand is one they can fix at 03:00.
The practical corollary is to look at the last ten incidents before adding a mechanism. If they were caused by deployments and configuration, multi-region active-active is not the highest-value investment — progressive delivery and configuration validation are, and they cost far less complexity.