Designing for Five-Nines: An SLA Engineering Playbook

99.999% availability allows for 5 minutes and 15 seconds of downtime a year. Not a month — a year. Most organizations that ask for five-nines haven't internalized what that number actually costs in architecture, process, and organizational discipline before they commit to it in a contract.

Architecturally, five-nines rules out entire categories of design that are perfectly acceptable at three or four nines. Single-region active-passive fails: failover alone, even automated, tends to burn 60–90 seconds you don't have. It has to be active-active across regions, with request routing that detects and reroutes around a degraded region before a human is paged.

The database layer is usually where five-nines commitments quietly die. Synchronous cross-region replication protects consistency but adds latency that breaks the SLA on the write path; asynchronous replication protects latency but risks data loss on failover. We've found the workable middle path is workload-segmented: strict consistency for transactional writes with a tighter regional footprint, eventual consistency for read-heavy paths that can tolerate replication lag.

On the operations side, five-nines demands a 15-minute P1 response commitment, not a 15-minute P1 resolution commitment — the two get conflated constantly. What you're actually engineering for is detection and initial mitigation inside that window: automated rollback, traffic shedding, or failover, with root-cause analysis happening after the bleeding stops, not before.

The trade-off worth being honest about with stakeholders: five-nines roughly doubles infrastructure spend versus four-nines, and it demands an SRE discipline — blameless postmortems, error budgets, chaos testing — that most organizations underestimate the cultural cost of adopting. Before committing to the number, ask which workloads actually need it. Segmenting your estate by criticality and applying five-nines only where the business impact justifies it is usually the more defensible engineering decision.