Tolerances for Partial Outages

A partial outage is a disruption in which a service continues in some form while failing in another: some channels work and others do not, some features work and others do not, some users can proceed and others cannot, or the service works but with inaccurate or delayed information. Such outages are common, and they are easy to underestimate, because the headline message that the service is partly available sounds reassuring. A tolerance for partial outages asks whether that partial service is good enough to avoid intolerable harm, and it answers that question in terms of what users can actually do, not in terms of what proportion of systems remain running.

The illustration here is a card payment service in which one payment route fails while another remains available. Customers who can use the working route may experience only minor inconvenience. Customers who cannot, because they lack the alternative route or because merchants do not accept it, experience a full stop in practical terms. The tolerance must therefore judge the outage from the perspective of the affected users, not from the perspective of overall system availability, and it must recognise that partial availability can coexist with intolerable harm.

Partial outages take many shapes, and each shape harms users differently. A channel partial outage removes one route while leaving others, which helps users who can switch and harms users who cannot. A feature partial outage removes a specific function, such as viewing recent transactions, while leaving payments working, which harms users who need that function for a decision. A user group partial outage affects customers in one region, using one device type, or served by one provider, which creates uneven harm that a general status message can obscure.

A full stop is unambiguous. Everyone affected knows the service is unavailable, and the firm knows it must act. A partial outage is ambiguous, because the firm must decide whether the remaining service is sufficient, whether the affected group is large or vulnerable enough to trigger escalation, and whether users understand the limitation. That ambiguity creates a risk of drift, in which a partial outage continues for a long period because it never quite reaches the threshold for urgent action, while the affected group continues to suffer.

A tolerance covers partial harm by describing, for the service, which degraded states count as intolerable. That description should cover channel loss, feature loss, uneven user impact, and data inaccuracy, in terms relevant to the service. It should also address duration in a partial state, because a degraded service that persists can become intolerable even if its initial degradation looked manageable. The tolerance therefore needs both a shape description, what partial failure looks like, and a persistence description, how long that degraded state can continue before harm becomes intolerable.

Partial tolerances go wrong when they are expressed only as overall availability, without any account of who is affected or what is inaccurate. Overall availability can remain high while a specific group is fully blocked, and it can remain high while data is wrong for everyone. A second failure is to treat partial outages as lesser incidents by default, so that they receive slower escalation and vaguer communication than full stops. Severity should be judged by harm, not by the technical footprint, and a partial outage causing severe harm deserves the same urgency as a full stop causing similar harm.

A reader can test a partial outage tolerance by asking which channels, features, user groups, and data qualities are covered, and how long a degraded state can persist before harm becomes intolerable. Further questions concern workarounds and communication: can affected users actually use the workaround, and does incident communication name the affected activity plainly? If those questions have no answer, the partial dimension needs further work, however well the full stop tolerance may be written. Judging partial service from the affected user perspective, rather than from overall availability, keeps the tolerance honest about the harm that remains while a service looks partly restored.