What an error budget is
An error budget is the unreliability your SLO permits. If the target is 99.9%, the remaining 0.1% is not a failure to hide — it is an allowance you can spend on deploys, migrations, experiments and the occasional bad day. As long as some budget is left, the service is meeting its objective.
The value of the idea is that it turns an argument into arithmetic. Product wants to ship faster, operations wants stability; the budget says how much risk is currently affordable. Plenty left: ship. Nearly gone: slow down and fix what is burning it.
Request-based budgets
Count good and bad events: budget = total requests × (1 − SLO). Best for APIs and anything with steady traffic, because a short outage at peak hurts more than one at night.
Time-based budgets
Count bad minutes: budget = window × (1 − SLO). Simpler to measure with uptime checks and easier to explain to customers.
Burn rate
How fast you are spending compared with an even pace. 1× uses the whole budget exactly by the end of the window; 2× uses it in half the time.
Rolling windows
Most teams use a rolling 28 or 30 days, so one bad incident does not disappear at midnight on the first of the month.
What to do when the budget is running out
Agree the policy before you need it. A common one: above 50% remaining, release normally; below 25%, require an extra review for risky changes; at zero, stop feature releases until the service has earned some budget back. Whatever the thresholds, write them down while nobody is under pressure.
Frequently asked questions
How is an error budget calculated?
Subtract the SLO from 100% and apply the result to the window. For a 99.9% SLO over 30 days that is 0.1% of 43,200 minutes, or 43.2 minutes — or 0.1% of all requests served in those 30 days.
What is a good burn rate?
Anything at or below 1× means you will finish the window inside the budget. Short spikes above 1× are normal; a sustained rate above 1× means the SLO will be missed unless something changes.
Should I use request-based or time-based budgets?
Use request-based when you have reliable success and failure counts, because it weights incidents by how many users they affected. Use time-based when availability is measured by periodic checks.
What happens when the error budget is exhausted?
Technically the SLO is missed for that window. In practice it triggers whatever policy your team agreed: usually a pause on risky launches and priority for reliability fixes until the budget recovers.