SREcon21 - Trustworthy Graceful Degradation: Fault Tolerance across Service Boundaries