Degrade a dependency graph under severe overload without guessing

• Start with business journeys and define which outcomes must survive: checkout may outrank recommendations, but fraud checks may still be mandatory. Establish legal, safety, and data-correctness functions that cannot be bypassed even in brownout.

• Model fan-out amplification, concurrency, pool occupancy, retry budgets, and queueing delay across dependency levels. A two-times arrival spike can create a twenty-times internal call spike when retries and scatter-gather paths multiply.

• Protect critical journeys, reject work before resources are consumed, preserve control traffic, and recover without a thundering herd. Degradation decisions must be centrally understandable but locally executable.

• Define a versioned priority taxonomy and propagate deadline, priority, tenant, and cost budget in request context. Edge admission enforces global capacity; each service reserves critical pools, sheds optional work, and consumes a bounded per-request retry budget.

• A request carries an absolute deadline and remaining work budget through every hop. Services return typed overload signals, not ambiguous timeouts; clients choose a documented fallback, enqueue, or fail-fast response based on journey policy.

• Brownout may omit derived or stale-tolerant features but cannot weaken monetary, authorization, or inventory invariants. Queueing a mutation requires durable acceptance and idempotency; otherwise the system must clearly reject it.

• Coordinate circuit thresholds with dependency capacity and use adaptive concurrency limits near the saturated resource. Recovery ramps admitted work gradually, drains priority lanes first, and keeps retries jittered and budgeted.

• Priority is assigned by trusted policy, never accepted directly from customers. Emergency bypasses are narrow, time-bound, audited, and incapable of skipping mandatory security or compliance decisions.

• Build journey-level SLOs plus load-shed, fallback-quality, deadline-exhaustion, retry-amplification, and saturation metrics. Correlate protections across the graph so operators see whether a local breaker preserved or damaged the global outcome.

• Keep reserved capacity for control and critical journeys, while allowing normal borrowing before an incident. Quantify the revenue and customer cost of each degradation level so overprovisioning and brownout policy are business decisions.

• Central admission sees global demand but not every local bottleneck; local adaptive control reacts quickly but can produce inconsistent user outcomes. Combine a shared policy vocabulary with local enforcement and typed feedback.

• Instrument deadlines and retry budgets first, then introduce typed overload responses, shadow admission, optional-feature brownouts, and finally automated ramps. Run dependency-failure exercises with executives agreeing to the product degradation order in advance.

• Distinguished-level reasoning spans architecture, product policy, and organizational governance. The answer should show how 180 teams converge on shared semantics while retaining local control, and how protections are tested as one system.

Interviewer evaluation rubric