AI Executive Office — CXO Assistant Platform  ·  View 25 of 30  ·  6 · Operations

Degradation Contract

A written statement of what still works when each dependency fails — and the one case where the platform refuses rather than degrades.

Editable source SVG draw.io All views
KPI answer Investigation Document search Approve and execute Morning brief Azure OpenAI unavailable Works measure, no prose Queued Keyword only Works Numbers only AI Search unavailable Works No citations states the gap Down Works Works Fabric capacity throttled Cached, aged as-of shown Degraded Works Works Delayed A source system is down Last good, flagged Partial, named which domain is blind Works Blocked for that system Coverage stated Execution plane down Works Works Works Approvals held, queued never lost Works Decision store unavailable Read-only answers Not recorded so refused Works Refused no record, no action Refused Degradation Contract — What Still Works When Something Fails Read the bottom row. If the decision cannot be recorded, the platform refuses to act rather than acting unrecorded — the one place it is designed to fail closed. v 1.0 · owner Data & AI Global Practice · date 2026-09

Why this is a deliverable

  • Graceful degradation is a requirement in the brief. It is only real if it is written down per dependency and per capability, agreed with the tenant, and tested — otherwise it is an aspiration that resolves to a 500 at 07:10
  • Read the bottom row. If the decision cannot be recorded, the platform refuses to act rather than acting unrecorded. Everywhere else it fails open with a stated caveat; here it fails closed
  • Every degraded state names itself in the answer. A silently partial answer is worse than an error

Numbers

  • Cached KPI values are served up to 24 hours old with the as-of date shown, then withheld
  • Approvals are queued rather than lost when the execution plane is down, and re-checked for authority when it returns
  • Degradation states are exercised in a quarterly game day, per tenant tier

Assumptions

  • Keyword-only search during a model outage assumes AI Search's own BM25 path stays available — it is a separate service from Azure OpenAI, which is why the fallback exists at all
◀  Model and Prompt Lifecycle All views Security Zones  ▶
Solution Architecture v1.0 · Azure-native, multi-tenant, sovereign-capable · Data & AI Global Practice · 2026-0925-degradation-matrix