A degraded mode is a planned, reduced version of your service that runs when a dependency fails or load spikes. Rank features by importance, switch off the expensive and optional ones first, keep authentication and authorisation checks on, and exercise the mode regularly so it works when needed.
Degrade, do not collapse
The Google SRE book describes graceful degradation as reducing the work done per request, for example serving from a smaller cache or using a cheaper ranking method when load is high. It adds two warnings: exercise the path regularly, because unused code paths tend to break, and alert when many servers enter degraded mode.
Step 1: rank your features
List what your service does and sort it into tiers.
- Tier 1, must stay: login, authorisation checks, core transactions, audit logging.
- Tier 2, keep if possible: search, notifications, profile updates.
- Tier 3, drop first: recommendations, analytics, exports, previews, nonessential background jobs.
Get product and security to agree on the tiers before anything breaks.
Step 2: security checks are not optional features
Never put a security control in the drop list to save capacity. The easy mistake is to disable a slow authorisation lookup or skip input validation under pressure, which turns an overload into a breach. Cheaper versions are fine: a cached authorisation decision with a short lifetime beats no check. A shorter, safer path is the aim, not a missing one. This is the same trap as failing open.
Step 3: define the triggers
Decide what moves you into degraded mode: queue depth, error rate, latency of a dependency, an operator's switch. Automatic triggers react faster. A manual switch is easier to reason about. Many teams use both. A kill switch or feature flag is a natural control for Tier 3 features.
Step 4: tell the user
Show a plain message when a feature is paused, rather than a spinner or a cryptic error. Quiet failures generate duplicate retries, which add load. See retry storms.
Step 5: test it
Turn the degraded mode on in staging every month. Run a load test or inject a dependency failure and confirm that Tier 1 holds, Tier 3 is off, and recovery is clean. The SRE book also recommends testing what happens when noncritical backends stop responding. Make sure the way back to normal does not cause a stampede.
Step 6: watch for abuse
Attackers sometimes aim to push a service into its weaker mode. If degraded mode relaxes anything, treat entering it as a signal worth alerting on.
Quick check
Who decides the tiers?
Product and engineering together, with security signing off that no control sits in the drop list.
Is degraded mode the same as a circuit breaker?
No. A circuit breaker stops calls to one failing dependency. Degraded mode is the plan for what the whole service does without it.
Sources
Last reviewed: 19 October 2026.
