The difference between an incident and a catastrophe is often whether the system failed gracefully. Architecture that contains failures — isolating blast radius by design — turns potential disasters into manageable events.
“Plan to fail in pieces, not all at once.”