Tolerance in Volume and Scope

A tolerance in volume and scope answers a question that duration cannot answer on its own: how many users, and how much activity, can be disrupted before harm becomes intolerable? A service that stops for a small group may look minor in headline terms while causing severe harm to that group, and a service that degrades for a very wide group may cause widespread inconvenience that, taken together, crosses the line into intolerable harm. Volume and scope therefore describe the breadth of a disruption, and breadth must be judged alongside length and data effects rather than as a separate curiosity.

The illustration here is a bulk payment service used by employers to pay staff. If that service fails for a single employer, the affected employees still face real harm, even though the failure is narrow in overall terms. If it fails for a large number of employers at once, the harm spreads across households and into other services that depend on those payments arriving. The tolerance must be able to distinguish those cases and to say, in advance, where breadth itself makes the harm intolerable.

Scope means the reach of a disruption across users, channels, and connected activity. A service is rarely used by a uniform group. Some users have alternatives, some do not. Some channels can substitute for others, and some cannot. A payment service that fails online but remains available through another channel has a narrower scope than a failure that removes every route at once. The tolerance should reflect that difference, because users experience scope as the availability of an alternative, not as a count on a dashboard.

A narrow outage can be intolerable when the affected group has no alternative and the consequence for that group is severe. Consider a service used by a specific group of customers who rely on it for essential payments and who cannot easily use another provider. Even if that group is small in the context of the whole firm, the harm to each person in the group can be serious, and the firm has judged that harm intolerable in advance. Breadth alone, without attention to vulnerability and dependence, would miss that judgement entirely.

Scope and duration amplify each other. A wide disruption that lasts only briefly may be absorbed, while the same wide disruption sustained over a longer period becomes steadily harder to absorb as workarounds run out and obligations accumulate. Conversely, a narrow disruption sustained over a long period can become intolerable for the affected group even though the wider firm continues to operate normally. Incident managers therefore need to read scope and duration together, watching whether the affected group is growing, shrinking, or remaining stuck while time passes.

Scope tolerances go wrong when they are expressed only as a share of total activity, without any account of who is affected. A share can look reassuring while hiding severe harm to a concentrated group, and it can look alarming while describing a broad but shallow inconvenience. A second failure is to assume that scope is static. Disruptions spread as users retry, as queues build, and as connected services react, so the scope at the start of an incident may not be the scope at its peak. A tolerance that assumes a fixed scope will be overtaken by the incident it was meant to judge.

A reader can test a scope tolerance by asking which users are affected, whether those users have an alternative, and how the disruption spreads to connected services. Further questions concern change over time: does the tolerance anticipate that scope can grow during an incident, and does the incident plan include a step to reassess scope at intervals? If those questions have no answer in the supporting material, the scope dimension is incomplete, however precise its wording may appear. Reading scope together with duration and data gives a fuller picture, because breadth, length, and accuracy each reveal a different part of the harm a disruption causes.