Saga compensation design
Price the manual exception path in a saga
Rare partial failures can require substantial investigation. Include reconciliation and operator capacity when comparing distributed workflow designs.
In this article
Map the work left after automation stops
For each unresolved state, identify which systems an operator must inspect and what decision they need to make. A missing carrier response may require one lookup, while conflicting effects across several services can demand coordinated business judgement.
Measure active handling time separately from waiting for a provider or approver. These delays affect staffing and customer experience differently.
Do not assume a low incident count means low cost. A small number of difficult cases can consume specialist time and leave resources reserved for long periods.
Reduce ambiguity in the record
Stable operation identifiers, clear state meanings and direct links to downstream results can make recovery much cheaper. A generic failed status forces the operator to reconstruct the workflow from logs.
Preserve the distinction between definite rejection and uncertain acceptance. It determines whether retry, compensation or reconciliation is appropriate.
Invest in synthetic fault tests that exercise the difficult states. They reveal missing evidence before an operator encounters the problem with real business data.
Compare architectural alternatives
Some workflows can avoid a distributed commitment by delaying an effect, using a reservation or keeping a tightly coupled invariant within one service. Those options may reduce compensation complexity, though they can introduce other constraints.
Do not distribute a transaction solely to gain a cleaner service diagram. Compare the operating cost of partial states with the actual benefit of independent services.
Where a saga is justified, design the manual path as a supported product capability. Include permissions, ownership and a way to prevent automated retries from racing with intervention.
Budget for an outage, not only isolated failures
A dependency outage can leave many sagas unresolved at once. Estimate the backlog and the rate at which automated and human recovery can clear it while new work continues.
Prioritise according to business consequence and age, with ordering constraints preserved. A simple first-in queue may not suit every effect, but any alternative needs an explicit rule.
The total cost includes the machinery that reaches a correct state after failure. A workflow that is inexpensive when every service succeeds can still be costly to operate if its exception path is slow, ambiguous or unowned.
Primary sources
Microsoft Learn: compensating transactionsAWS Builders' Library: idempotent APIsReferences checked 11 September 2026.