The budget hiding in the target
Flip a 99.9 percent objective around and you get an error budget. A tenth of a percent of your requests are allowed to fail, which over 30 days is 43 minutes of total downtime, or proportionally more of partial degradation.
Notice what that reframing quietly does. It converts reliability from a moral question, where every failure is somebody's shame, into a resource question, where failures have a balance.
Spend it, because a budget invites spending. Deploys, risky migrations, chaos experiments and planned maintenance all consume budget, and that is exactly what it is for.
Ship aggressively when most of the month's budget is intact. Slow down when you have burned it. In the strict version, an exhausted budget triggers a freeze, where nothing ships except reliability work until the window recovers.
Value the rule for what it really does, which is politics. Product wants velocity and operations wants stability, and the budget replaces that standing argument with arithmetic both sides agreed to in advance.
Burn rate beats thresholds
Fix your alerting with it too. Paging on raw error counts either wakes people for blips or sleeps through slow disasters.
Alert on burn rate instead: how fast is the budget draining compared to the pace that would exactly exhaust it by the end of the window? A rate of one spends the month's budget in a month. A rate of fourteen spends 2 percent of it in a single hour, the standard threshold worth waking somebody for.
Run two windows, which is the mature setup. A fast-burn alert over one hour that pages a human, and a slow-burn alert over three days that files a ticket. You catch the sudden fire and the slow leak, and ignore the noise that resolves itself.
Worked example
Priyanka's team runs a checkout API with a 99.9 percent SLO, a budget of 43.8 minutes a month, and a burn rate dashboard everyone can see. In March, a bad canary burns 12 minutes on the 4th and a cloud provider issue eats 19 more on the 11th. On the 19th, with 70 percent of the budget gone and twelve days left, the policy the team signed last year kicks in without a meeting: the risky search-migration launch slides two weeks, and the sprint fills with the retry-storm fix everyone had been deferring. The product manager grumbles but signed the policy too. April runs clean, the budget resets, the migration ships. The notable part is what did not happen: no escalation, no VP thread, no hero pushing a launch through an unstable system. The arithmetic decided.