Cascading failures that stop at the boundary.

The pattern showed up in every postmortem: a third-party API got slow, the calling threads accumulated, the application’s connection pool exhausted, unrelated requests started failing. The third-party slowdown was the trigger; the cascade was the architecture.

We added Resilience4j to the service boundaries: circuit breakers with sensible thresholds, bulkheads to isolate connection pools per downstream, timeouts set against measured p99 latencies. Step Functions orchestrated the fallback flows where degraded service was better than no service.

In the 120 days after rollout, the platform survived seven distinct third-party outages without customer-visible impact. Healthy-state p99 latency actually improved 14% — head-of-line blocking from slow downstreams had been silently degrading the median.