Trade-off Analysis
Every architectural choice costs something. The work is naming what, and deciding with the cost visible.
There Is No Best, Only Suited
The senior habit is answering "it depends" and then saying what it depends on. Vague answers come from not knowing the axes; good answers name the quality attributes in tension and the constraint that decides between them.
Quality Attributes In Tension
| Gaining | Usually costs |
|---|---|
| Strong consistency | Availability under partition, and latency |
| Low latency | Freshness — caching means serving something older |
| Scalability via services | Operational complexity and network failure modes |
| Flexibility and configuration | Comprehensibility — more paths to reason about |
| Security controls | Convenience, and sometimes throughput |
| Delivery speed now | Rework later, if the shortcut is not repaid |
| Cost efficiency | Headroom — the thing you want during an incident |
Note that most of these are not resolvable, only positionable. CAP is the well-known example: during a network partition you choose consistency or availability, and no architecture escapes the choice — it only decides where on the dial you sit.
A Usable Method
| Step | Detail |
|---|---|
| Name the drivers | The two or three attributes that actually matter here |
| Quantify them | Numbers with units — latency, volume, RPO, RTO, budget |
| List real options | Including "do nothing" and "the boring one" |
| Score against the drivers | Explicitly, and note what each option sacrifices |
| Check reversibility | How expensive is undoing this in a year |
| Decide and record | In an ADR, with the sacrifices written down |
Driver: order writes must survive an AZ failure with RPO = 0
Option A — single-region multi-AZ synchronous replication
+ RPO 0, simple operationally
− Write latency +8ms; no region-level protection
Option B — multi-region active-active
+ Survives region loss
− Conflict resolution in the application; ~3× cost; large complexity jump
Option C — single AZ with backups
+ Cheapest, simplest
− RPO measured in minutes — fails the driver outright
Chosen: A. B is not justified until a region-loss requirement exists.Reversibility Changes The Answer
How hard a decision is to undo should change how much analysis it deserves, and how much risk is acceptable.
| Type | Approach |
|---|---|
| Two-way door — cheap to reverse | Decide fast, at the lowest level, and move on |
| One-way door — expensive to reverse | Options, evidence, a written record, more people |
| Reversible but costly | Prototype or spike before committing |
| Irreversible in practice | Data models, public API contracts, tenancy — slow down |
You can also buy reversibility deliberately: an abstraction at a boundary, a feature flag, a strangler pattern round a legacy component. Each costs a little now to keep an option open — and like any option, it is only worth buying where the uncertainty is real.
Interview Questions
What makes a good answer to an architecture question?
Naming the quality attributes in tension and the constraint that decides between them. "It depends" is only useful when followed by what it depends on.
Give an example of an unavoidable trade-off.
Consistency versus availability during a network partition. No architecture escapes it; the design only chooses where to sit and what to do when the partition happens.
Why insist on numbers in requirements?
"Fast" cannot eliminate an option. "p99 under 200ms at 500 requests per second" rules several out immediately and makes the comparison objective.
How does reversibility change the process?
Two-way doors should be decided quickly at the lowest level. One-way doors — data models, public contracts, tenancy — deserve options, evidence and a written record.
Why evaluate the boring option?
A single well-run relational database and a monolith meets most requirements. The burden of proof belongs to the more complex proposal, not the simpler one.
How do you buy reversibility?
An abstraction at a boundary, a feature flag, or a strangler around a legacy component. Each costs something now to keep an option open, and is only worth it where uncertainty is real.