Automating actions on error budget burn

WHAT THIS TESTS: Whether you can turn the error budget from a reporting metric into a live control signal that drives alerting and automated remediation, using burn rate rather than static thresholds.

A GOOD ANSWER COVERS: The key concept is burn rate, the speed at which the budget is being consumed relative to the SLO window. A burn rate of one would exhaust the budget exactly at the end of the window; higher rates exhaust it faster. Use multi-window, multi-burn-rate alerting: a high burn rate over a short window (for example a fast burn over minutes) pages immediately, while a moderate burn over a longer window opens a ticket, balancing fast detection against false alarms. For automation, map burn-rate tiers to actions. On a rapid burn shortly after a deploy, automatically freeze further deploys and trigger a rollback of the most recent release, since recent changes are the likeliest cause. Other automated responses include scaling out capacity if the burn is load-driven, shedding non-critical load, or switching to a degraded fallback mode. Escalate tiers: warn, then block deploys, then page and roll back. Every automated action must be logged, reversible where possible, and capable of escalating to a human.

COMMON WRONG ANSWERS: Alerting on absolute budget remaining rather than burn rate, which fires too late. Single-window alerts that are either too noisy or too slow. Automating irreversible or risky actions with no guardrails, or coupling automation so tightly that a metric glitch triggers a needless rollback.

LIKELY FOLLOW-UPS: How do you pick burn-rate thresholds and windows? When should burn trigger automation versus just paging? How do you prevent a noisy SLI from triggering false rollbacks?

ONE CONCRETE EXAMPLE: A service deploys at noon; by 12:05 the burn rate spikes to 14x over a five-minute window. The system pages on-call, automatically blocks further deploys, and rolls back the noon release. The burn rate drops, confirming the deploy was the cause, and the rollback is logged for the postmortem.