Pattern
Graceful Degradation plan
Define how consequential work continues or stops when AI, data, tools, identity, or outside services are unavailable or untrusted. The plan sets modes from normal operation to safe stop, and a fallback counts only once it has been exercised. Deployment stops when the operation cannot fail safely.
Inputs
Critical work, dependencies, service limits, staffing, queues, policies, recovery objectives, and prior incidents.
Method
Specify normal, reduced authority, read only, manual fallback, and safe stop modes with triggers, priorities, owners, communication, recovery order, and reconciliation.
Output
A tested continuity plan and recovery drill record.
Boundary
A written fallback that has not been exercised is an assumption.
Stop
Stop deployment when the operation cannot fail safely within its consequence and time limits.