At a glance
What you need to know.
To maintain an agreed user journey as volume, dependencies and failure exposure increase, start with a complete business journey and its operating constraint. This guide examines a contract boundary around a legacy master record, then connects the design choice to an observable result. The walkthrough is illustrative guidance; targets, access and readiness must be established for the actual system.
Start with a contract boundary around a legacy master record
Legacy architecture work benefits from a narrow contract around the record that remains authoritative. Inventory direct database readers, export jobs and informal updates before introducing a new interface. Describe the business meaning of fields rather than copying historical table names into a public API. Keep compatibility rules explicit and compare old and new outputs with stable references. A facade is useful when it gives a supported boundary and migration path; it becomes another dependency if nobody owns its validation, monitoring and retirement decisions.
A legacy estate is an active business system, not merely old code. Locate scheduled jobs, shared files, identifiers and approvals that users rely on before replacing a component. Some dependencies appear only at a month-end or exceptional transaction. Establish a way to compare old and new results using stable business references. Where systems coexist, decide which one owns each write and how conflicts are reconciled. A temporary bridge needs a removal condition and an owner, otherwise it becomes another permanent dependency.
Choose the enterprise architecture boundary that changes the result
Map the critical journey's dependency chain and identify shared failure domains. Independent deployment does not ensure independent failure when services share a database, identity authority or exhausted worker pool. Assign service objectives to useful boundaries and budget timeouts across the whole request. Decide which information can be stale and which operation must stop when authority is unavailable. Rehearse restoration and compatibility after partial failure. Architecture review should ask whether operators can diagnose and recover the journey, not only whether components have redundancy.
Resolve the decision within this operating context
Rehearse the new boundary and the old destination together, including a missed batch, unavailable interface and partial transfer. Keep writes owned by one system or an explicit reconciliation contract during coexistence. Define a fallback that does not silently create competing records. Decide when to cut over based on destination-state evidence and restoration capability. A successful new endpoint is insufficient when an essential legacy job still fails after the request is acknowledged.
Illustrative walkthrough and failure case
Exercise a new customer API backed by an old master-data process while its most important dependency is slow or unavailable. Choose the facade's acknowledgement contract and the point at which a proposed change becomes an accepted master-record change. Record the user-visible pending state and inspect durable progress after recovery. Test with the workload that creates contention, rather than only an empty demonstration account, and compare the useful result with the agreed objective.
The facade validates an update but the legacy batch later rejects it. Return a pending state until authoritative acceptance is known and preserve the rejection reason for the business owner.
Define the acceptance metric before the pilot
Define a service-level indicator around a useful user journey: accepted request, successful retrieval or durable completed job. Specify eligible events, success conditions and the measurement window. Review latency percentiles and failures by customer or workload class, not only a global average. Agree an objective with the business owner based on consequences and operating capacity. Google SRE distinguishes the measured indicator from the target objective; a provider's availability commitment does not automatically describe your application or its downstream dependencies.
Exercise slow and unavailable dependencies, duplicate work, restart and restoration under a representative load. Confirm timeouts and retries are bounded, work remains traceable and the interface represents pending or degraded state honestly. Test recovery using the actual data and permissions required by the journey. Compare failure and latency indicators with the agreed objective before expanding rollout. Scaling instances proves capacity only for the tested workload; it does not prove recovery from corrupt data, an invalid release or a missing authority service.
Release a supported change and retain ownership
Record the decision, its assumptions, accepted tradeoffs and the owner responsible for revisiting it. Version the affected contract and identify consumers before rollout. Use a compatibility period or controlled cutover that the operating teams can rehearse. Review the actual deployed diagram, permissions and recovery paths after release. Architecture governance is useful when it helps a team make and maintain a decision; a reference diagram without ownership, migration evidence and an operating procedure cannot establish that the business capability is ready.
Before you start.
- What useful user result does the reliability objective measure?
- Choose the facade's acknowledgement contract and the point at which a proposed change becomes an accepted master-record change.
- Which restricted role, correction and dependency failure belong in acceptance?
- Who owns unfinished work and reconciliation during the pilot?
- Which baseline, workload assumptions and stop condition are recorded?
Common questions.
How should we measure scaling reliability?
Define the user journey, eligible events and success rule first. Set an objective that reflects business impact and the team's ability to operate it. Measure dependency failures and recovery as well as healthy requests; a fixed-success health endpoint cannot establish journey reliability.
What should the first pilot cover for a contract boundary around a legacy master record?
Use one bounded journey involving a new customer API backed by an old master-data process, with its actual authority, source records and operating owner. Choose the facade's acknowledgement contract and the point at which a proposed change becomes an accepted master-record change. Include the failure case and confirm accepted destination state before expanding. A successful screen or resource-creation receipt is evidence of that stage, not proof that the full journey is ready.