Autoscaling Controller  ·  View 05 of 37  ·  2 · Structure

The Critical Design Decision

The decision plane never calls a capacity API. The red arrow is the path the architecture forbids.

Editable source SVG draw.io All views
Decision plane — reads, never calls Signal Reader read-only identity Policy Evaluation versioned policy Damping and Bounds the only place Journal Writer inputs and arithmetic The join — a written record Desired-State Record one integer per target Decision Id 1 : 1 with actuation Actuation plane — calls, never decides Reconciler delta from observed Provider Adapters actuate identity Serving Verifier counts what serves never actual capacity Decision Plane and Actuation Plane, Joined by a Record Application we own Data store Interface / broker failure / alternate event / async The red path is the one the architecture forbids. A decision that could call a capacity API would make crash recovery, idempotency and audit all unprovable at once. v 1.0 · owner Data & AI Global Practice · date 2026-09

The decision

  • Decision plane ≠ actuation plane, joined only by a durable desired-state record.
  • The decision plane reads signals, evaluates policy, damps, clamps, and writes one number with the reasoning that produced it.
  • The actuation plane reads that number, observes what is serving, and converges the two. It holds no policy and no thresholds.

What follows from it

  • A crash mid-decision loses nothing: the fleet holds its last declaration and reconciliation resumes.
  • Partial failures and lost responses converge instead of compounding, because the delta is re-derived from observed actual capacity.
  • Oscillation, hysteresis and rate-limit logic has exactly one place to live and one place to be audited.
  • Every capacity change in the fleet's history is explainable from a written record rather than reconstructed from metrics.

The cost

  • One extra durable write on the critical path, budgeted at p99 2 s for the decision and 3 s to first actuation call.
  • Two components to operate rather than one, and a state store whose availability is now an availability dependency of the fleet's ability to change size — though not of the fleet's ability to serve.
◀  Layered Architecture All views Container Architecture  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 37 views · Azure and open source05-plane-separation