Quality Attributes

Introduction

Quality attributes — availability, latency, scalability, security, modifiability — are the non-functional requirements that determine whether Netflix survives peak streaming hours. Staff architects translate business goals into measurable attribute scenarios before choosing topology.

Real production story

When Netflix migrated recommendation serving to a new microservice mesh, engineers optimized for modifiability and accidentally regressed latency on the home row API. Changelog-driven deploys looked healthy while member start-up time silently climbed. A quality-attribute workshop surfaced the conflict: personalization teams needed weekly deploys; playback needed sub-100ms p99. The fix was explicit attribute prioritization, separate SLO tiers, and chaos tests scoped to each attribute — not another org chart redraw.

Business problem

Netflix competes on instant playback and personalized discovery. Vague NFRs like "fast and reliable" cause teams to optimize different attributes locally until member experience degrades in ways dashboards do not capture.

• Member churn: Buffering and slow row load directly correlate with cancellation — latency is a revenue attribute.
• Release velocity: Hundreds of daily deploys require modifiability without sacrificing availability SLOs.
• Regulatory trust: Parental controls and billing require security and auditability as first-class attributes.

Architecture overview

Quality attributes are testable properties of the system under specified conditions. Staff practice: write attribute scenarios (source, stimulus, environment, response, measure) and map each to architectural tactics.

• Definition: Measurable system properties — not aspirational adjectives in slide decks.
• Tactics: Caching improves latency; redundancy improves availability; interfaces improve modifiability.
• Trade-off pairs: Performance vs security, availability vs consistency — document which wins where.
• Verification: Chaos engineering, load tests, and fitness functions prove attributes — not design reviews alone.

Architecture motivation

Attribute-driven design forces architects to name scenarios, stimuli, and responses before picking microservices vs monolith. Without this, Netflix teams debate technology instead of measurable outcomes.

• Force: Conflicting attributes (consistency vs availability on watch history) need explicit winners per use case.
• Constraint: Cannot gold-plate every attribute — cost and complexity have ceilings.
• Outcome: Architecture diagrams annotated with attribute priorities and SLO links.

Internal architecture

Attribute layering at Netflix — each tier owns specific quality targets:

• Attach SLO tier (Tier-0 playback, Tier-1 browse, Tier-2 batch) to every service registry entry.
• Attribute scenarios drive which tactics apply — do not copy last year's diagram.

Member client
   ↓  [latency: interactive p99 < 300ms]
API Gateway (Zuul / custom edge)
   ↓  [availability: 99.99% per region]
Domain microservices (stateless)
   ↓  [modifiability: independent deploy]
Persistence (Cassandra · EVCache · S3)
   ↓  [durability · replication factor]
Chaos / Simian Army (continuous verification)
   ↓
Observability (Atlas · Mantis · tracing)

Data flow

Attribute-sensitive paths differ: Playback prioritizes availability and latency; billing prioritizes consistency and auditability; batch ML prioritizes throughput over p99.

• Interactive path: Edge cache → regional API → read-optimized store → timeout budgets per hop.
• Transactional path: Strong consistency where required; saga compensation for cross-service writes.
• Batch path: Async pipelines with backpressure; never steal thread pools from Tier-0 services.

System design diagram

Two diagrams show the Quality Attributes topology and the primary request/event path used in production at scale.

Production code example

Attribute scenario registry — YAML consumed by architecture review tooling:

• Machine-readable scenarios enable CI gates — "latency attribute unverified" blocks prod promote.
• Link each scenario to an ADR so trade-offs survive team churn.

# quality-attributes/home-row-load.yaml
attribute: latency
priority: tier-1
scenario:
  source: member_on_android_tv
  stimulus: open_app_peak_evening
  environment: single_region_degraded_cache
  response: home_row_rendered
  measure: p99_ms <= 300
tactics:
  - edge_cache_with_stale_while_revalidate
  - bulkhead_playback_vs_personalization
  - timeout_budget_150ms_per_hop
verification:
  - load_test: nightly_home_row_10m_rps
  - chaos: terminate_evcache_pod_during_test
  - slo_burn_alert: 2h_window
owner: personalization-platform
adr: ADR-1842-home-row-latency-budget

Enterprise case study

Netflix personalization tier split: One team owned both row assembly and model inference — modifiability conflicts caused latency regressions.

• Before: Shared deploy pipeline; p99 row load 800ms during model experiments.
• Decision: Split services, attribute workshop, Tier-1 SLO for row API, async model refresh path.
• After: Model teams deploy daily; row p99 < 250ms; chaos tests validate fallback rows.

Trade-offs

• Latency vs consistency: Watch progress can be eventually consistent; subscription billing cannot — split stores and SLOs.
• Modifiability vs performance: Extra abstraction layers ease change but add hop latency — measure before adding.
• Security vs usability: Stricter auth improves security attribute but hurts conversion — risk-based step-up.
• Observability vs cost: Full tracing on every request is expensive — sample strategically by tier.

Security considerations

Security as quality attribute: Confidentiality, integrity, and accountability have scenarios and measures like latency.

• Zero trust: Service identity per call; no implicit trust inside VPC.
• Data classification: PII paths require encryption and access logging — attribute scenario per data class.
• Supply chain: Dependency freshness and image signing are integrity attributes verified in CI.

Scalability analysis

Netflix scale stresses different attributes: evening peak hits latency; global expansion hits modifiability and operability; content catalog growth hits data scalability.

• Elasticity: Auto-scale stateless tiers; pre-warm caches before known launch events.
• Regional isolation: Blast-radius control is an availability attribute — fail regional, not global.
• Attribute regression: Load tests must include modifiability scenarios (deploy during test) not just RPS.

Failure scenarios

Attributes under failure: Chaos Monkey proves availability tactics; latency degrades when retries amplify — each attribute has a failure scenario catalog.

• Latency spike: Retry storms when recommendation service slows — bulkheads protect playback path.
• Availability hit: Regional EVCache loss must not block start-play — fallback to origin with grace.
• Security breach: Over-broad service tokens violate least privilege — attribute review includes blast radius.

Staff engineer insights

• If you cannot write an attribute scenario with a number, the requirement is not ready for architecture work.
• Netflix's chaos practice exists because availability is only real when continuously verified — slides do not count.
• When two teams disagree on design, they usually disagree on attribute priority — resolve that before debating Kafka vs RabbitMQ.

Interview questions

Architecture review questions

• Are top three quality attributes ranked with numeric targets?
• Does each attribute have at least one written scenario (source, stimulus, measure)?
• Are conflicting attributes resolved per use case, not globally?
• Is verification planned (load, chaos, security scan) before prod cutover?
• Do SLO tiers align with service registry and on-call routing?
• Is there an ADR when an attribute is intentionally sacrificed?

Summary

Quality attributes at Netflix scale drive every architectural tactic. Staff engineers write testable scenarios, prioritize conflicts explicitly, wire verification into CI and chaos programs, and tie SLO tiers to business outcomes — not buzzwords on architecture posters.