API Gateway Platform  ·  View 13 of 21  ·  Runtime

Degradation Paths

Seven dependencies, seven things given up, and the front door is not one of them.

Editable source SVG draw.io All views
What fails How it is detected What the request plane does What is given up How it recovers Counter store Memorystore shard down call timeout 5 ms local buckets only ceiling tightened limit accuracy shard back, counters reset Credential store identity backend down cache refill fails serve on cached verifier write routes fail closed revocation freshness denylist replay on reconnect Control plane config API unavailable snapshot poll fails keep serving version N the ability to change resume polling, no restart One upstream group all backends unhealthy active health check 10 s circuit break, fail fast cached response if allowed that route only half-open probe A slow upstream p99 collapse, no errors concurrency cap hit shed before pool exhausts some requests, not all callers cap released on recovery Telemetry pipeline Pub/Sub backpressure publish buffer full sample down, then drop evidence fidelity audit events never dropped A whole region region loss LB health check fails anycast withdraws region in-flight requests only re-admit after drill criteria Degradation Paths — What Each Dependency Failure Costs Every row gives up a dimension in column four. None of them gives up the front door. v 1.0 · owner Integration Platform Architecture · date 2026-09

The principle, made concrete

  • Column four is the whole page: every failure costs a dimension — accuracy, freshness, fidelity, the ability to change — and none of them costs availability.
  • The credential-store row is the one genuine split: read routes serve on a cached verifier, write routes fail closed. That asymmetry is ADR-04 and it is a values decision, not a technical one.
  • The control-plane row is what licenses a 99.9% target for the control plane against 99.99% for the data plane.

Numbers

  • Unhealthy backend removed from rotation within 10 s; regional evacuation client-visible RTO ≤ 120 s (assumptions).
  • Counter-store outage tightens local ceilings to the per-instance share of the limit rather than removing the limit.

Risks

  • Two simultaneous degradations are not drawn and are not well understood — a counter outage during a credential outage means approximate limits on stale credentials. That combination deserves a game day before launch.
◀  A Request From TLS to Upstream All views Quota Enforcement  ▶
Solution Architecture v1.0 · Google Cloud · Integration Platform Architecture · 2026-09 · 21 views · 18 architecture decision records13-degradation-paths