Backpressure Is a Governance Feature, Not a Performance Detail

Backpressure decides which work gets refused under load, and refusing work is a policy decision that deserves the same review as any permission rule.

When a system saturates, something gets dropped, delayed, or denied. If nobody designed that choice, the system is still making it, just without review.

Questions backpressure design should answer

• Which workflow classes yield first when capacity runs out.
• Whether safety-critical denials still execute at full load.
• How operators can see what was shed after the pressure clears.

Use the architecture guide, security docs, and benchmarks to make refusal order under load an explicit, reviewed decision.