Chaos Engineering Platform  ·  View 11 of 21  ·  Data

Data Model

Twelve entities; the spine that carries the design is definition, version, run, lease, applied fault.

Editable source SVG draw.io All views
ExperimentDefinition id PK slug owner_team created_by current_version DefinitionVersion id PK definition_id FK version hypothesis radius_limits abort_conditions immutable Run id PK version_id FK mode started_at ended_at verdict aborted_reason ResolvedTarget id PK run_id FK cluster zone workload replica_ref Approval id PK run_id FK approver tier over_cap expires_at RadiusReservation id PK run_id FK replica_pct zones downstream_set held_until Lease id PK run_id FK target_id FK fault_class issued_at expires_at renewals Finding id PK run_id FK service failure_class state remediation_ref AuditEntry id PK principal action subject_ref at GuardrailEvaluation id PK run_id FK check measure limit outcome AppliedFault id PK lease_id FK requested_params applied_params reverted_at revert_verified SignalSeries id PK run_id FK sli_ref window resolution_s samples 1 : N 1 : N 1 : N 1 : 1 1 : N 0 : N 1 : 1 1 : N Data Model — Experiments, Runs, Leases and Findings Approval, SignalSeries and AuditEntry also reference Run by run_id; those edges are omitted so the spine — definition, version, run, lease, applied fault — stays readable. v 1.0 · owner Reliability Architecture · date 2026-09

Decisions

  • A verdict is bound to a DefinitionVersion, never to a definition. A verdict you cannot tie to the exact document that produced it is an anecdote.
  • AppliedFault carries requested and applied parameters and a separate revert_verified flag, because reverted and verified-reverted are different facts.
  • Lease is a first-class entity with a renewal count, so the evidence bundle can show exactly how long permission was held and when it stopped.

Deliberate omissions

  • Approval, SignalSeries and AuditEntry also reference Run; those three edges are omitted so the spine stays legible. Crow's feet on twelve entities read as wiring, not as a model.

Risks

  • Finding has a lifecycle independent of its originating run, which means findings can outlive the definitions that found them. The remediation reference has to survive a definition being deleted.
◀  Data Architecture — Ownership and Rebuildability All views Critical Flow — One Experiment, Start to Verdict  ▶
Solution Architecture v1.0 · Google Cloud · Reliability Architecture · 2026-09 · 21 views · 16 architecture decision records11-data-model