SLO and Error Budget Service  ·  View 07 of 21  ·  Structure

Layered Architecture

Seven layers, and the one seam that decides what gets backed up.

Editable source SVG draw.io All views
Reader surface Reliability console Verdict API signed, typed Budget query API Monthly reports Control plane Definition reconciler from Git Admission checks Policy engine Exclusion workflow two approvers Computation plane Budget calculator Window manager Burn-rate evaluator Recompute engine preemptible Derived state Budget projection cache, rebuildable Compiled alert rules State of record SLO registry Azure SQL SLI aggregates Data Explorer Window snapshots immutable blob Audit ledger tamper-evident Ingest Indicator stream Event Hubs Event-time bucketer Quarantine typed reasons Measurement plane — outside Azure Monitor Managed Prometheus Synthetic probes outcome cube minute buckets version write range scan close window SLO and Error Budget Service — Layered Architecture Application we own Interface / broker Decision point Security / platform Data store Queue / topic Risk / gap External / third party event / async synchronous two-way Seven layers, and one seam that matters: the computation plane reads the state of record and writes only derived state. Nothing above the state-of-record layer is backed up, because nothing above it is data. The verdict API's read of the projection is omitted here and drawn in views 08 and 13. v 1.0 · owner Reliability Architecture · date 2026-10

Decisions

  • The seam is between the state-of-record layer and everything above it. Below the seam, data; above it, derivation. Nothing above the seam is backed up, because nothing above it is data (ADR-16).
  • The measurement plane is drawn as the bottom band and labelled "outside", so the set never reads as though the platform owns collection (ADR-02).
  • Quarantine sits in the ingest layer rather than the computation layer: a bad batch is stopped before it reaches the store that everything else derives from (ADR-08).

Assumptions

  • Derived state can be rebuilt from the state of record in ≤ 90 minutes for the full estate — assumed, and the basis for the recovery objective.
  • Minute-grain aggregates are retained 13 months, which bounds how far any recompute can reach.

Deliberately omitted

  • The verdict API's read of the budget projection, which would cross five bands and clutter the view; it is drawn in views 08 and 13.
  • Rule compilation and the audit write path, carried in views 14 and 20.
◀  Journey — Declaring an SLO All views Platform Components  ▶
Solution Architecture v1.0 · Microsoft Azure · Reliability Architecture · 2026-10 · 21 views · 17 architecture decision records07-layered-architecture