Card 1 of 50
Front. Owner. What does owning a shared service mean?
These cards are original study material. They are not questions from a named employer or a live hiring loop.
All 50 cards in this deck
1.Owner
What does owning a shared service mean?
Your team can change it, run it, and answer other teams when it fails. Many callers do not mean many owners.
2.Consumer
Who is an API consumer?
A team whose product breaks if your request, response, or errors change. They are part of the rollout, not an afterthought.
3.Usage
What do you check before removing an endpoint?
Who still calls it, from logs or a metric, over a window long enough to include rare jobs. A quiet week can hide a monthly caller.
4.Notice
What belongs in a deprecation notice?
The end date, the replacement, and a way for the caller to test that replacement. Callers can put the work on a schedule only when all three are in the notice.
5.Window
What is a deprecation window?
The time callers have to move while the old behavior still works. Ending it early is an outage you chose.
6.Scope-creep
Why keep a data migration from becoming a redesign?
A moving schema and a moving product at once means you cannot tell which change broke the read. Finish the move, then change the model.
7.Risk-line
How do you state an idempotency risk to product?
In the user's terms: a retry can charge twice, or create two orders. The word 'idempotent' alone does not change the decision.
8.Cost
What do you do after a job burns unexpected money?
Stop the spend, name the missing limit or alert, and add that guard. The next run of the same job should trip the guard before the bill moves again.
9.Stall
What do you do with a design doc full of comments?
Close the open questions in one meeting, write the decision in the doc, and start the first slice. Each comment gets an answer: accepted, or declined with the reason.
10.Revisit
When do you reopen a recorded decision?
When a fact it relied on has changed, such as the scale, the caller, or the cost. Write the new fact next to the old decision so the reason for reopening is visible.
11.Public-slip
How do you answer a slip in a public channel?
What moved, why, and the new date or the cut scope. Debugging the cause in the thread can wait for a smaller room.
12.Hero
What is wrong with one engineer fixing every incident?
The service cannot be repaired when they are away, and everyone else stays new. Put the next one in someone else's hands, with them beside.
13.Rotation
What belongs in an on-call rotation?
A schedule, a runbook, and a backup. A rotation of one person is a name, not a rotation.
14.Runbook
What makes a runbook usable at 2 a.m.?
The symptom, the check, and the action, in that order, with the command or the dashboard linked. The person on call can follow it without having designed the service.
15.Slo-dep
Why give a dependency its own error budget?
Your SLO cannot be tighter than the services you wait on. A budget makes that limit visible before you promise past it.
16.Breaking
What makes a change breaking?
A caller that followed the old contract now fails or misreads the result. Adding an optional field usually does not. Changing a meaning does.
17.Version
How do you run two API versions?
Both stay deployed until measured traffic on the old one is gone, and the old one is tested until that day.
18.Shadow
What is a shadow read?
The new path handles a real request and its answer is compared, then thrown away. Users still get the old answer.
19.Dual-write
What is the hazard of a dual write?
Two stores are updated in sequence, and a crash between them leaves them different. An outbox or a single writer avoids that gap.
20.Canary
What do you watch on a backend canary?
Error rate, latency, and the specific new path, against the old version. A green process is not a green feature.
21.Data-rollback
Why is rolling back data harder than rolling back code?
New code may have written a shape the old code cannot read. The migration has to be readable by both, or the rollback is a second migration.
22.Pager
What is pager load?
How often a human is woken for this service. A high load means the alert or the system needs work, not tougher engineers.
23.Toil
What is toil?
Manual, repeating operational work that does not leave the system better. If it grows with traffic, it will eat the team.
24.Delegate
How do you delegate a design you care about?
Name the boundary and the deadline, then let them choose inside it. Overruling each choice takes the ownership back.
25.Review
What is a design review for?
To find the failure before the build: which data you can lose, which caller breaks, and how you roll back. Those three are settled before anyone debates wording.
26.Comment
What do you do with a comment you will not address?
Say so, and why, in the doc. A silent ignore looks like the comment was missed.
27.Decision
What does a written decision save?
The next person asking 'why is it this way' gets the constraint, not a guess. It also stops the review from restarting.
28.Staffing
What do you do if the plan needs a skill you lack?
Name it early: hire, borrow, or cut the part that needs it. Hoping someone learns it on the critical path is a slip.
29.Mentor
How do you grow someone toward owning a service?
Give them a real slice, a reviewer, and the on-call for that slice. Watching you own it does not transfer the ownership.
30.Comms
Who speaks during a service incident?
One person gives status on a cadence. Everyone else fixing it stays out of the side conversations.
31.Severity
What should severity be based on?
Who is hurt and how badly, not which team owns the code. An internal tool and a checkout do not share a severity.
32.Impact
How do you describe customer impact?
How many people, which action failed, and the start time. Severity and the status update both come from those three, and they stay put while the cause is still a theory.
33.Follow-up
When is an incident follow-up done?
When the change is shipped, not when the ticket is filed. A ticket with no owner is a note.
34.Priority
How do you rank a migration against a feature?
By the cost of waiting: the next change it blocks, or the failure it leaves open. A migration with no such cost can wait.
35.Boundary
What is a service boundary for?
One team can change one side without a meeting for every caller. A boundary that still needs all callers in the room is a folder.
36.Library
When is a shared library the wrong reuse?
When teams need to ship the fix on their own schedule. A service, or a copied function, may move faster than a library everyone must bump.
37.Map
What is an ownership map?
A list of systems and the team that answers for each. An unowned system is the one that pages nobody.
38.Escalation
What is an escalation path?
Who to call when the on-call cannot fix it, written down before the incident. Inventing it at 2 a.m. wastes the first hour.
39.Capacity
What is a capacity plan?
How much headroom you have, what grows it, and the date you run out if nothing changes.
40.Contract-test
What is a contract test?
A check that the provider still speaks the request and response the consumer relies on. It fails in the provider's build, not in the consumer's production.
41.Flag-debt
What is flag debt?
Flags left on after the rollout. Each one is a branch the next change must still understand.
42.Freeze
When is a change freeze useful?
Around a known high-stakes window, with a named end. A freeze with no end just hides the deploy risk.
43.Postmortem
What do you ask of a partner team after your outage?
The fact they saw, and the change at the boundary. A postmortem that only covers your service misses a failure that crossed it.
44.No
How do you refuse a caller a special case?
With the constraint it would break for everyone else, and the supported path. A private exception becomes the real API.
45.Roadmap
What does a platform roadmap owe its callers?
The migrations that will be asked of them, with a season, so they can plan. A surprise breaking change is not a roadmap.
46.Hiring
What do you look for when hiring onto a service team?
Someone who can debug a system they did not write, and who writes the failure down. Puzzle speed is a weak signal for this seat.
47.Calibration
Why compare incident reviews across services?
So a checkout outage and a quiet internal error are not both called severe, or both shrugged off, by habit of the local team.
48.Budget-talk
How do you use an error budget in a planning meeting?
If it is spent, reliability work is the plan. If it is full, you can spend some of it on shipping. The number is the argument.
49.Hand-off
What does a good hand-off include?
The current state, the next risk, and who decides. 'You own it now' with none of those is how context dies.
50.Measure
What do you measure to see if a migration worked?
The share of traffic on the new path, and the errors there, not the number of tasks marked done.