Graceful Degradation

Try it: climb the degradation ladder with feature flags

Black Friday load rises while a personalization dependency browns out. Turn flags off in priority order so checkout keeps working even when nice-to-have surfaces go stale or static.

What actually happens

The degradation ladder

Plan a ladder from rich experience to basic service. Each step should be deliberate, reversible, observable, and understandable to users.

Degradation playbooks

A playbook converts "degrade gracefully" into exact triggers, actions, user messages, owners, exit rules, and metrics.

Feature flags for controlled degradation

Feature flags flip functionality without redeploying binaries: perfect for instantly disabling risky widgets when metrics spike or dependencies lag.

if (featureFlags.isEnabled("recommendations")) {
  return recommendationService.getPersonalized(userId)
}
return fallbackService.getPopularItems()  // Static cache
// Circuit breaker triggers flag. Propagation: < 5s across 10K servers

Static fallbacks and cache-only mode

Serving last-known-good HTML or CDN assets buys minutes to hours while databases recover. Users notice staleness but stay productive versus staring at 500s: often via stale-while-revalidate. A stale response is acceptable only within the data’s correctness contract. An old catalog description may still be useful, while a cached permission decision or inventory quantity can authorize an invalid action. Mark freshness when it affects decisions and revalidate critical state at the write boundary. Ensure the fallback can be served without contacting the same failed dependency it is meant to replace.

Queue-based load leveling

Queues absorb bursts: clients enqueue work instead of hammering synchronous endpoints, but backlog grows if consumers lag. Monitor depth and age alongside enqueue latency, and apply backpressure when the queue is no longer useful.

Choosing what to degrade under pressure

Degrade the work that consumes scarce resources without protecting the main promise of the product.

Million-user degraded modes

A dependency outage at million-user scale should turn into lower-quality answers, not a blank page. Predefine the fallback for each expensive feature.

Priority-based load shedding

When CPUs saturate, load shedding drops lowest-value requests first: analytics, previews, heavy personalization. So carts and authentication stay responsive under siege.

Circuit breaker with fallback chains

Circuit breakers stop hammering sick dependencies; chain multiple fallbacks (fresh → stale cache → static) so each hop degrades quality smoothly instead of failing closed immediately. Keep fallback chains short and cheaper at each step. If personalized ranking times out, a precomputed popular list can avoid the failed ranking service entirely. If that list is unavailable, a static response may preserve navigation. Give the whole chain one deadline; assigning a full timeout to every fallback can make degraded mode slower than the original failure.

Degradation strategy patterns

Pattern-match to your domain: pre-ranked services, ruthless protection of media/checkout paths, and manual toggles exercised quarterly.

Deepening: feature degradation contracts