Platform error budgets that actually work

An error budget only matters if it has teeth. Ours blocks deploys when burned, pages the owner, and resets on a calendar the team actually respects — not a quarterly target that everyone quietly misses.

We set two signals: availability as measured at the edge, not inside the cluster, and latency at p99 rather than the average that hides the tail. Both are queried from the same source the customer experiences, so the budget cannot be gamed by moving the measurement point.

The mechanics are boring on purpose. A proto file for the SLO, a query that returns a single number, and a deploy gate that reads it. Every revert to the gate is logged as an incident, which is why the budget gets taken seriously: burning it creates a paper trail that survives the sprint.

What we changed

• Error budgets enforced at the deploy gate, not just charted.
• p99 latency and edge-measured availability as the two counted signals.
• Weekly review of burns with the engineer who owns the service, not the manager who reports on it.

If your budget is a spreadsheet nobody opens, it is not a budget — it is a wish.