Spend an error budget, then slow the change

A reliability target sounds like a wish until it is turned into a number a team can spend. The allowed failure is the budget, and how fast it is going is the signal that should decide whether change speeds up or slows down.

Derive the budget from the target

A target of nearly perfect availability leaves a small budget. Write it down as the amount of failure allowed in the window, so a debate about speed becomes a question about the number.

Measure the spend over a window

Count failure across the whole window, not one request at a time. A run of small failures can empty a budget that no single request looked bad enough to stop.

def spend(events, window):
    bad = [e for e in events if e.window == window and e.failed]
    return len(bad) / max(1, len(events))

Slow the risky change, do not freeze everything

When the budget is nearly gone, hold the change that carries risk and let the safe work continue. A blanket freeze punishes the work that costs the budget least.