What is Graceful Degradation?

It requires an explicit ranking of functionality by importance. A commerce site can lose recommendations, reviews, and personalization while checkout continues, but only if someone decided in advance which components are shed and which are protected.

The implementation uses fallbacks, feature flags, and load shedding. When a dependency fails, the calling code returns a reduced response rather than propagating the error. When load exceeds capacity, lower priority requests are rejected so higher priority ones still complete.

Partial service is almost always better than none, and the difference is frequently the difference between an incident and an outage.

• Preserved revenue: core transactions continue while peripheral features are down.
• Contained failures: one component failing does not take the whole product with it.
• Reduced urgency: a degraded system can often wait for business hours.
• Load survival: shedding low priority work keeps the system responsive under a spike.

Degradation can be invisible, which is dangerous. If a feature silently returns empty results when its dependency fails, error rates stay clean and nobody notices that the product is broken. Every degraded path needs its own telemetry and usually a user visible indication.

Degraded paths also rot. Code that runs only during failures is rarely exercised, and a fallback that has not run in a year may not work when it is finally needed. This is one of the strongest arguments for chaos experiments.

Failover replaces a failed component with a healthy equivalent: another replica, another region, another provider. Full functionality is preserved and the requirement is having a redundant copy available.

Graceful degradation reduces functionality when no equivalent is available. If a recommendation service is down everywhere, failover has nothing to switch to, and degradation means showing the page without recommendations. Failover handles infrastructure failure, degradation handles capability failure, and a system needs both because not every capability can be made redundant.