Understanding Site Topics Fundamentals 3: Costs, Limits and Trade-offs

Teams working on rate limiting usually discover this the hard way. A design that cannot be rolled back is a design that cannot be changed safely. Latency budgets are easier to defend when every hop has a stated ceiling. This is most visible in rate limiting. Consider rate limiting specifically. Caching helps only until the invalidation rules become the bottleneck.

Access Control: Configurations should be reviewable in a diff, not only in a console. Access Control: The best time to add an index is before the table gets large. Access Control: Failures are usually correlated, so plan for the shared dependency.

You can often replace a coordination problem with an idempotency key. The same reasoning holds for api design. For api design, the constraint matters more than the feature list. Anything that grows without a bound will eventually hit one. Teams working on api design usually discover this the hard way. Documentation that is not tested tends to describe the previous version.

You can often replace a coordination problem with an idempotency key. The same reasoning holds for search indexing. For search indexing, the constraint matters more than the feature list. Anything that grows without a bound will eventually hit one. Teams working on search indexing usually discover this the hard way. Documentation that is not tested tends to describe the previous version.

If the rollback plan needs a meeting, it is not a rollback plan. That applies to access control as well. In practice, access control behaves differently: Small pages that stay small are easier to keep fast than large ones made fast. Write the invariant down; otherwise it lives only in someone's memory. The same reasoning holds for access control.

Use direct language and describe the limit in practical terms. For example: “I want to use a condom every time we have sex,” or “Please ask before taking or sharing photos of me.” A person can briefly explain why, but they do not have to prove that a boundary is reasonable. If the limit is not yet clear to them, they can say so and ask to pause while they decide.

Release Process: Periodic jobs should be safe to run twice, because they will be. Release Process: You rarely need a new component to fix a boundary problem. Release Process: The signal you want is often already logged, just not aggregated.

Teams working on cost controls usually discover this the hard way. The interesting number is not the average, it is the 99th percentile. Adding a cache in front of a slow query is a fix; fixing the query is a cure. This is most visible in cost controls. Consider cost controls specifically. Every abstraction you add is a place where behaviour can differ from intent.

For log analysis, the constraint matters more than the feature list. Configurations should be reviewable in a diff, not only in a console. Teams working on log analysis usually discover this the hard way. The best time to add an index is before the table gets large. Failures are usually correlated, so plan for the shared dependency. This is most visible in log analysis.

Listening is part of the conversation. Ask what the other person understands, and invite them to describe their own boundaries without treating the exchange as a negotiation in which every limit must be traded away. Open questions such as “What would help you feel comfortable?” can clarify expectations. If a question feels intrusive, either person can decline to answer it.

For access control, the constraint matters more than the feature list. Periodic jobs should be safe to run twice, because they will be. Teams working on access control usually discover this the hard way. You rarely need a new component to fix a boundary problem. The signal you want is often already logged, just not aggregated. This is most visible in access control.

A design that cannot be rolled back is a design that cannot be changed safely. That applies to schema markup as well. In practice, schema markup behaves differently: Latency budgets are easier to defend when every hop has a stated ceiling. Caching helps only until the invalidation rules become the bottleneck. The same reasoning holds for schema markup.

Serving static bytes is the cheapest thing you can do at the edge. That applies to data pipelines as well. In practice, data pipelines behaves differently: A schema is an interface; changing it is a migration, not an edit. Track the denominator as carefully as the numerator. The same reasoning holds for data pipelines.

API Design: Periodic jobs should be safe to run twice, because they will be. API Design: You rarely need a new component to fix a boundary problem. API Design: The signal you want is often already logged, just not aggregated.

If a metric has no owner, it will drift until it causes an incident. This is most visible in cloud infrastructure. Consider cloud infrastructure specifically. The cheapest optimisation is usually removing work nobody asked for. Cloud Infrastructure: Aggregating at write time trades flexibility for predictable read cost.

Schema Migration: A queue smooths spikes but also hides how far behind you are. Retries without jitter turn a small outage into a large one. That applies to schema migration as well. In practice, schema migration behaves differently: Separating the reads from the writes buys room to change either side.

Search Indexing: The interesting number is not the average, it is the 99th percentile. Search Indexing: Adding a cache in front of a slow query is a fix; fixing the query is a cure. Search Indexing: Every abstraction you add is a place where behaviour can differ from intent.

Cloud Infrastructure: The first thing to settle is the failure mode, not the happy path. Measurements taken once are anecdotes; you need a baseline that repeats. That applies to cloud infrastructure as well. In practice, cloud infrastructure behaves differently: Costs usually concentrate in a small number of operations, so find those first.

Data Pipelines: If a metric has no owner, it will drift until it causes an incident. Data Pipelines: The cheapest optimisation is usually removing work nobody asked for. Data Pipelines: Aggregating at write time trades flexibility for predictable read cost.

Consent is ongoing. A person can withdraw it at any point, including after previously agreeing or after an activity has begun. If they say stop, move away, become unresponsive or otherwise indicate discomfort, pause immediately and ask what they want. Do not argue, bargain or demand an explanation.

For cost controls, the constraint matters more than the feature list. If a metric has no owner, it will drift until it causes an incident. Teams working on cost controls usually discover this the hard way. The cheapest optimisation is usually removing work nobody asked for. Aggregating at write time trades flexibility for predictable read cost. This is most visible in cost controls.

Rate Limiting: The interesting number is not the average, it is the 99th percentile. Rate Limiting: Adding a cache in front of a slow query is a fix; fixing the query is a cure. Rate Limiting: Every abstraction you add is a place where behaviour can differ from intent.

Cost Controls: The first thing to settle is the failure mode, not the happy path. Cost Controls: Measurements taken once are anecdotes; you need a baseline that repeats. Cost Controls: Costs usually concentrate in a small number of operations, so find those first.

Consider monitoring alerts specifically. The interesting number is not the average, it is the 99th percentile. Monitoring Alerts: Adding a cache in front of a slow query is a fix; fixing the query is a cure. Every abstraction you add is a place where behaviour can differ from intent. That applies to monitoring alerts as well.