One tenant fills the queue. What changes?
A single tenant now produces three quarters of the request load.
The question
Northline’s shared queue feeds workers with a combined 12,000-request/second capacity. A new tenant imports a large history while other tenants send live dispatch updates.
| Requests/second | |
|---|---|
| Import tenant | 9000 |
| All other tenants | 3000 |
| Worker capacity | 12000 |
| Required live reservation | 4000 |
Capacity is authored. Averages hide which tenants wait behind the import.
Live dispatch traffic from other tenants must retain 4,000 requests/second of reserved capacity during the import. The import may be throttled and resumed. The database and identity service remain shared.
“Choose admission and isolation boundaries, then state what they do not protect.”
Not saved by this site. Your browser may restore text when you navigate back.
A strong answer, step by step
Open each step in turn. This is one strong answer, not the only one.
Step 1: Separate the service classes
What would you do here? Open the move you’d make.
Use FIFO because total arrivals equal total capacity.
Tempting, but it misses something. FIFO does not preserve a per-class reservation or burst latency.
Throttle the resumable import to the remaining 8,000 requests/second.
The strong move. The stated live reservation remains available.
See how a strong candidate says it
“Reserve 4,000 requests/second for live tenants, leaving at most 8,000 for the import while that reservation holds.”
Why it works: The import’s 9,000 arrival rate exceeds its admitted capacity by 1,000 per second.
Step 2: Choose the bound
What would you do here? Open the move you’d make.
Carry the reservation through queue scheduling and worker limits.
The strong move. This prevents the hot queue from occupying the whole fleet.
Add a second queue but let every worker drain the longest one.
Tempting, but it misses something. The import can still consume the shared execution budget.
See how a strong candidate says it
“Use separate queues and admission limits by tenant or service class, with worker scheduling that enforces the reservation.”
Why it works: Two queue names alone do not reserve worker or connection capacity.
Step 3: Name the remaining dependency
What would you do here? Open the move you’d make.
Declare full isolation because each tenant has a queue.
Tempting, but it misses something. The shared services remain common failure paths.
Load-test per-cell database and connection budgets.
The strong move. This tests the shared dependency still named in the packet.
See how a strong candidate says it
“Cells can limit customer impact, but the shared database and identity service can still fail across cells.”
Why it works: A tenant boundary is useful only where capacity, connection and failure limits are actually enforced.
Step 4: Make the cost visible
What would you do here? Open the move you’d make.
Choose strict reservation first, or test bounded borrowing with reclaim.
The strong move. Either choice names the utilization cost and the protection it must retain.
Always lend idle capacity and assume the import stops instantly.
Tempting, but it misses something. Without a reclaim mechanism, the reservation is not a guarantee.
See how a strong candidate says it
“Reserved live capacity can be idle when live demand is 3,000 rather than 4,000. Borrow it only with a fast, tested reclaim rule.”
Why it works: Utilization and isolation trade off; a strict reservation and bounded borrowing are both defensible when their contracts are clear.
The answer, in short
- Decision
- Protect the live reservation and throttle the resumable import.
- Because
- The requirement permits delaying the import; it does not permit sacrificing live tenants to improve aggregate utilization.
- What would change it
- A different live reservation, import deadline or measured reclaim delay changes admission and cost.
Common traps
- Treating total throughput as tenant fairness.
- Calling separate queues complete isolation.
Check your answer
- Did I name the protected traffic?
- Is admission consistent with worker scheduling?
- Did I identify shared dependencies?
- Did I price the reserved or borrowed capacity?
Last reviewed Nov 10, 2026