Graceful degradation: Reference architecture

Places a breaker per downstream dependency with an explicit fallback, a bounded half-open probe budget, and no shared breaker that hides a tenant-specific outage.

Published Sep 12, 2026