01 Check what the rollback changes
A binary rollback can leave the failing configuration in place.
A binary rollback can leave the failing configuration in place.
“This delayed detection by nearly an hour.” (opens the source)
A planned change does not explain away an alert.
“Set the evaluation window, failure criteria, and maximum failure count.” (opens the source)
Set a failure condition and an observation window before the change.
“Protect customers from repeated SLO misses” (opens the source)
Apply the service's written policy to its own error budget.
“consistent controls to prevent unwanted mutations of production state.” (opens the source)
Check the cited signal and permitted action before changing service state.
A healthy API is one signal. Queue lag and unmeasured regions still need checks.
Last reviewed Nov 10, 2026