Admission Gate with SLA Capacity and Cost

1) The real problem: a sold contract is not proven capacity

A B2B opportunity can look commercially attractive and even pass a pilot while still being unsafe to admit. Before admission, the promised service level must fit measured capacity, current quotas, failover reserve, and current cost-to-serve. “We have autoscaling,” “we can raise the quota later,” and “we will optimize later” are plans, not present capacity.

2) Lesson boundary and deliverable

The deliverable is Admission Gate Decision Contract v1. This lesson consumes a forecast but does not redesign forecasting; it also does not own the cost ledger or pricing-floor outcome. The bounded state is ADMIT, CONDITIONAL, REJECT, or HOLD, reproducible from visible evidence.

3) Keep SLI, SLO, and SLA distinct

An SLI is a quantitative service measure, an SLO is a target for that measure, and an SLA is an agreement that includes consequences around the SLO. A bare “99.9%” without the indicator, window, and consequence is not a testable admission contract. The gate must know exactly what is being promised.

4) Quotas and constraints are real limits

AWS Well-Architected treats service quotas and resource constraints as reliability limits and calls for sufficient gap to accommodate failover. A quota-increase request therefore does not count as current capacity until the required Region/account has approved and observable headroom.

5) From forecast to capacity envelope

The baseline uses P95 demand of 820 req/s and a reproducible load test that proves 1,000 req/s before degradation. Reserving 180 req/s for failover leaves an effective envelope of exactly 820 req/s. That is feasible, but it has no buffer; it is weaker evidence than a system with proven headroom.

6) Make capacity margin explicit

Here effective_capacity = tested_capacity - failover_reserve and capacity_margin = effective_capacity - p95_demand. MAKNOW DESIGN requires at least 10% of P95 as capacity margin for ADMIT. If hard constraints pass but the buffer is smaller, only a valid time-bounded exception may produce CONDITIONAL; an exception cannot create physical capacity that does not exist.

7) Check quota in every failure domain

Primary-Region headroom is not proof of failover readiness. If the architecture depends on a second Region, its quota and usage also need evidence. Missing failover-Region quota evidence is not zero and not pass; it produces HOLD because the failure-mode promise is not yet knowable.

8) Unit cost and margin are a separate gate

FinOps Unit Economics connects technology cost to business units such as tenant, transaction, or cost-to-serve. This lesson uses commercial_margin = price_or_value_basis - cost_to_serve; that margin must reach margin_floor. Overall company revenue does not substitute for workload-specific cost-to-serve evidence.

9) Serviceability and freshness come before optimism

Unknown serviceability, stale load testing, or a forecast/cost model that no longer matches the admission context must produce HOLD. HOLD is not a commercial failure; it means the decision does not claim more certainty than the evidence supports.

10) Baseline: why CONDITIONAL?

The baseline has explicit SLO/SLA, P95=820, tested capacity=1000, and failover reserve=180, leaving zero capacity margin. Quota and current economics pass their hard constraints and serviceability is PASS, but the design buffer is absent. A short-lived exception with an owner and expiry therefore permits CONDITIONAL; without that exception, admission is not allowed.

11) Wrong shortcut: future capacity is not current capacity

If P95 rises to 900, the current tested envelope after reserve remains 820. An open quota ticket or configured autoscaling does not change the evidence. The state is REJECT until new capacity/quota evidence exists and the gate is rerun.

12) What makes an exception valid?

An exception needs an owner, scope, expiry, and stop/pivot trigger. An expired or ownerless exception is not evidence. An exception may define a review window for missing evidence, but it must not turn UNKNOWN into PASS. It also must not waive a known physical capacity shortfall.

13) Lab: rebuild the gate from fixtures

The lab contains eight synthetic fixtures. The evaluator performs deterministic checks for effective capacity, capacity margin, quota headroom, commercial margin, freshness, and exception validity. Start with the baseline, then run higher P95, missing failover quota, higher unit cost, expired exception, and stale-evidence mutations. The objective is the correct bounded state, not a positive answer.

14) Transfer: stricter contract, mixed evidence

The transfer raises the service tier, increases P95 by 15%, approves quota only in the primary Region, and raises cost-to-serve. Recompute rather than copying the baseline: P95 becomes 943 req/s, above the tested 820 req/s envelope. The stop condition is explicit: do not admit until a new load test, failover quota evidence, and refreshed unit economics pass the gate.

15) Delivery checklist

A defensible contract records service tier, SLI/SLO/SLA and window, forecast ref and P95, tested capacity, quota/usage/headroom, failover reserve, capacity margin, unit cost/cost-to-serve/margin floor, serviceability, freshness, exception owner/expiry, state, stop/pivot trigger, and evidence ref. Never record a future plan as present capacity.