Serving
SLO latency budget
The latency targets a service commits to, split per phase: time to first token, speed while reading, and the whole reply. Every serving change argues from it.
An SLO (service level objective) is a promised ceiling on how long users wait, usually stated at a percentile such as p95 rather than on average. A latency budget is the SLO turned inside out: instead of one number at the end, the wait is divided into phases and each phase gets an allowance it must stay inside.
The split matters because the phases are paid differently. The wait for the first token is prefill plus queue, so its budget is spent by shortening prompts, prefix caching, and admission. The wait per token is decode, so its budget is spent by bandwidth: quantization, batch sizes, faster cards. A budget without that split cannot say which change to make, and an optimization argued without a budget cannot say whom it helps.
The percentile is the honest part. Mean latency hides the user having the worst morning; p95 names them. Budgets therefore attach to p95 (and often p99 for the first token), and capacity is sized so the tail holds, which is also why they are watched as queues and headroom rather than reviewed as a monthly average.
A worked example
A chat product commits that a 500-token reply finishes within 20 s at p95, and that prefill takes 0.4 s at p95.
- Decode budget: 20 - 0.4 = 19.6 s for the 500 tokens.
- Required decode rate at the tail: 500 / 19.6 = 25.5, so the SLO implies about 26 tokens per second per user at p95.
- Any change that drops per-user decode below 26 at the tail - a bigger batch, a cheaper card - breaks the commitment, whatever it gains elsewhere.
The commitment converts into a decode floor of about 26 tokens per second per user at p95, a number any serving change can be judged against.
Where this shows up
- Serving AI ReliablyThe AI feature launched ten days ago and is the quietest thing you operate: the dashboard is a strip of green graphs, no complaints, nothing shipped this week. Then at 3am something changes, and running this feature is different because the dependency is a model you neither wrote nor can restart: a provider answers your users, and the provider can change its capacity, its pricing, or the model itself without telling you. So the board grows meters that watch the call rather than your code. p95 latency, the wait that 95 of every 100 requests stay under, catches a capacity squeeze that the median wait, p50, smooths right over. The error share catches a rate limit, a provider ceiling on how many calls fit in a minute that a launch surge can trip with zero code changes. Daily spend catches a prompt edit that quietly broke the prefix cache, the discount a provider grants while your requests resend the same opening text. And an eval set, a small fixed list of prompts with expected answers that your code reruns on a schedule, catches the scariest one: a silent quality drop after the provider swapped the model, the failure users notice and no latency meter ever blinks. What you do about it is the fallback ladder, an ordered list of answers to serve while the model misbehaves: retries with backoff first, then a smaller or older model, then a cached reply, ordered so the user meets slow long before they ever meet gone. Pinning, writing the exact model version into your config instead of floating on the provider default, is what turns a swap back into a rollback. Interviewers ask what you watch and what you do at 3am: a specific ladder is the answer of someone who ran a live AI feature, and we would monitor things is the answer of someone who has not. The three challenges below grade exactly that: the order you triage a crowded alert board in, the p95 and eval math that tells you to roll a model version back, and the share counters that say whether the ladder is holding.
- Design ChatGPT: Tiers & Rate LimitsDesign ChatGPT is the most-cited systems design question at AI companies, and it is really one question: when everyone arrives at once, who gets served, who waits, and who is told no, all without the paying tier ever noticing. The answer interviewers grade against has three parts. First, three pools: a small provisioned pool whose cards exist for one tier only, a larger shared pool where paid requests carry priority over free ones, and the queue itself, which lives in card memory, not in a message broker. Second, a token-bucket rate limiter at the gateway, held in Redis for atomicity under concurrent writers, that admits free arrivals at a chosen share of demand and reconciles the token count after each grant, so a burst of arrivals is answered instantly without consulting a GPU. Third, shedding: a request refused at the gateway with a 429 costs nothing; the same request admitted into a saturated pool holds an expensive seat and lengthens every wait behind it, which is why the tail wait punishes utilization non-linearly, and why an incident that removes 30% of capacity can turn a 97 millisecond paid wait into an 850 millisecond one. Interviewers test this because every knob in the design is a money or trust decision: renting burst capacity for a launch day, tightening the bucket over a jammed pool, or letting the free tier shed so the subscribers do not notice an outage. The three challenges below work the mechanics: the admit count a token bucket grants, the queue wait the utilization formula quotes, and the shed arithmetic that keeps the shared pool from jamming.