Risk Appetite
The amount and type of risk an organisation is willing to accept in pursuit of its objectives, stated explicitly enough to guide a design decision.
Architecture is continuous risk acceptance, and without a stated appetite each architect substitutes their own — which is why two teams in the same company produce wildly different designs for comparable problems, and why review boards argue about instincts.
A usable statement is specific and quantified. "We accept up to four hours of unavailability per year for internal systems and up to fifteen minutes for customer-facing payment flows." "We will not accept any risk of unauthorised access to customer financial data, and will accept degraded functionality to prevent it." "We accept a single-region deployment for services below this revenue threshold." Those are sentences an architect can design against.
The value is not only in constraining designs but in making over-engineering visible. A team building multi-region active-active for a system whose stated tolerance is four hours of downtime is spending money the organisation did not ask for, and the appetite statement is what makes that conversation possible without it becoming a judgement about the team.
The failure mode is an appetite expressed as an adjective — "we have a low appetite for operational risk" — which constrains nothing and is compatible with any decision. If it cannot resolve a specific design choice, it is a sentiment rather than a control.