Eliminate first, then compare
Most architecture decisions aren't really comparisons. A residency requirement, a latency budget or a licensing term rules some options out before anyone has to weigh the rest. Apply the hard constraints first. Only then is it worth comparing what's left, and the table below is for that second step.
The common decisions
| Decision | Choose the first when | Choose the others when | What it implies |
|---|---|---|---|
| Monolith, modular monolith or microservices | A small team, one domain | Modular: clear domains, one deployment. Micro: independent scaling, many teams | Microservices multiply identities, network paths, telemetry and partial failures. Going from modular to micro is the cheapest path |
| VM, container or serverless | Legacy software, host-bound licensing | Containers: portable and dense. Serverless: spiky load, small operations team | Serverless is cheapest at variable load and has the highest exit cost |
| SQL or NoSQL | Integrity, ad hoc queries | Known access patterns at massive scale | Moving from NoSQL to SQL later means remodelling |
| Synchronous or asynchronous | An immediate answer is needed | The work can wait | Asynchronous needs idempotency, dead-letter queues and message-level authorization |
| Batch or streaming | Hourly freshness is fine | Reactions within seconds | Streaming is an always-on cost; a batch job reruns easily |
| Managed or self-hosted | A commodity capability | Control, residency, high utilisation | Managed adds a dependency on the provider's control plane |
| Cloud or on-premises | Elasticity, managed services | Data gravity, sovereignty, steady use | Capital against operating cost; hardware lead times against provider incidents |
| Single cloud or multi-cloud | Integration depth | Regulatory diversity, a need for E4 features, intolerance of one provider as Tier-0 | Doubles the IAM models. Resilience only if failover is tested |
| Central or federated identity | One workforce identity provider | Partners, acquisitions, customers | Federation adds signing-certificate failure points; changing identity provider is Type-1 |
| Vector or hybrid search | Prose full of paraphrase | IDs, codes, names, legal text | Hybrid adds index cost; changing the embedding model forces a re-embed |
| Frontier API or open-weight model | Top quality, variable load | Residency, steady high volume, customisation | Self-hosting wins only at high GPU utilisation |
| One model or routing | Consistency | Cost tiers, resilience | Every route needs approval and its own evaluation |
| Workflow or agent | The steps can be listed | Open-ended choice of tools | Agents bring the ASI risks, more tokens and new kinds of failure |
| Kubernetes or VMs | Many services, GPU sharing through DRA | A few stable applications | Kubernetes adds a cluster blast radius and version churn |
Second-order effects
The first-order benefit of a decision is why you make it. The second- and third-order effects are why it surprises you a year later. Each row reads left to right: the decision, what it buys, what it costs, what that cost then causes, the risk that follows, and where it ends up.
| Decision | Benefit | Cost | Second-order effect | Second-order risk | Third-order consequence |
|---|---|---|---|---|---|
| Microservices | Independent deployment | Network calls | Partial failures, version skew | Retry storms, tail latency | Observability and platform maturity become prerequisites |
| Multi-cloud | Supplier diversity | Several IAM models | Duplicated policy | Inconsistent authorization | A larger attack surface; resilience only if failover is tested |
| Self-hosted AI | Control, residency | Your own infrastructure | GPU capacity management | Utilisation pressure against queueing latency | Scheduling, with DRA and quota queues, becomes a platform of its own |
| A central API or model gateway | One policy point | A shared dependency | A larger blast radius | The gateway is Tier-1 or Tier-0 | It needs multi-region, configuration discipline and bulkheads |
| Zero trust | Per-request authorization | More checks | More identity dependencies | Policy latency; a PDP outage is an access outage | Caching decisions creates a revocation budget |
| Vector search | Semantic recall | Derived data | Deletions and ACL changes must propagate | Stale permissions; residual vectors | Freshness SLOs, lineage, re-embedding migrations |
| Kubernetes | Portable orchestration | A cluster control plane | Platform engineering | Upgrade skew; CRD and operator sprawl | The cluster lifecycle becomes a major operational system |
| Private endpoints everywhere | No public path | DNS complexity | Private DNS zones owned centrally | Misresolution; on-premises forwarders as single points of failure | DNS becomes a security boundary, and Tier-0 |
| Workload identity federation | No static keys | A dependency on the STS and identity provider | JWKS and issuer availability | A federation outage is a machine outage | Issuer URLs and audiences become Type-1 constants |
| Event-driven integration | Decoupling in time | Eventual consistency | Duplicates and reordering | Non-idempotent consumers corrupt state | Outbox, idempotency keys and replay tooling become mandatory |
| Multi-region active-active | Surviving a region | Write conflicts | Conflict-resolution semantics | Lost updates, split brain | The data model is redesigned around CRDTs, ownership or partitioning |
| Long token lifetimes with CAE | Availability | Revocation delay | A dependency on the event channel | Non-participating resources ignore revocation | An inventory of which resources honour revocation |
| Aggressive caching | Latency, cost | Staleness | Invalidation paths | Stampedes on expiry | Jittered TTLs, request coalescing, fail-static |
| Stateless MCP (2026-07-28) | Horizontal scale | State moves into the application | Handles, and re-issue on a broken stream | Duplicate side effects | Idempotency keys on every side-effecting tool |
| Copilot DLP location | A second decision | A separate policy estate, with other locations disabled | Duplicated policy | Drift between Copilot and workload DLP | Policy as code across both estates |
| Security agents (EDR) | Detection | Kernel privilege; auto-update | A shared dependency across the fleet | A fleet-wide crash, as with Channel File 291 | Content rings; customer control of rollout |
| A fast global configuration path | Quick mitigation, such as bot rules | A fast blast radius | Configuration generated from queries | An upstream permission change is a configuration change | Validate size and cardinality; fail static to the last known good |
How the domains couple
Every domain on this site touches the others. These are the joins where a failure in one shows up as a failure in another.
| Pair | Through what | The failure that characterises it |
|---|---|---|
| Identity and network | An identity-aware proxy replaces network trust | An identity-provider outage is an access outage |
| Identity and data | Row-level security and ACLs read from claims | Group-sync lag exposes rows |
| Identity and AI | On-behalf-of against agent identity | Token pass-through creates a confused deputy; a blueprint is compromised |
| Network and security | Egress control and inspection | TLS inspection breaks pinned clients |
| Data and AI | Indexes are derived data | Deleted data persists in the vectors |
| Compute and cost | Utilisation multiplied by price | Idle reserved GPUs |
| AI and security | Language as an instruction channel | Indirect prompt injection |
| AI and data governance | Labels and DLP | Unlabelled sensitive content |
| Microsoft 365, Entra and Azure | A shared tenant; consent | Illicit consent; compromise of the whole tenant |
| Cloud and on-premises | Hybrid AD, DNS, dedicated links | An on-premises AD compromise reaching the cloud |
| Kubernetes, cloud and observability | Workload identity; short-lived pods | IAM misbinding; a cardinality explosion |
| Security and operations | Auto-updating agents | A fleet-wide crash |
| Time and identity | Token expiry; clock skew | Valid tokens rejected |
| Time and data | Watermarks; last-writer-wins | Writes silently reordered |
| DNS and security | Private endpoints | The zone owner controls the path |
| Configuration and everything | P8 | A bad push reaches every region in seconds |
| Organisation and ownership | Conway's law | A boundary with no owner becomes an unmonitored dependency |