Engineering Decision Framework
At the end of this plan, you'll be able to answer these questions in design reviews and incidents with code-level confidence:
| Question | You'll know |
|---|---|
| "Should we build or buy a WAF?" | The algorithms, their limits, and the maintenance cost |
| "Which DDoS protection settings do we actually need?" | What each layer does, what it costs in latency, and what you'd need to replicate it |
| "Why is our bot rate 40%?" | How to measure it, what signals to add, what to tune |
| "Can we do mTLS between services without a service mesh?" | Yes — and you've built it |
| "Why does our WAF have false positives on this endpoint?" | Exactly which rule matched and how to write the exception |
| "How do we do zero-downtime deployment for the security proxy?" | FD inheritance and the 3-stage drain pattern |
| "Our rate limiter is causing latency spikes" | Token bucket vs sliding window tradeoffs and how to profile it |