When the team reports an outage, ask "what status codes are users seeing?" That alone narrows the problem space:
- Everyone gets 404 → routing, DNS, deploy that removed an endpoint
- Everyone gets 500 → application bug, recent deploy, downstream dependency
- Everyone gets 502 → upstream targets unhealthy, app crashing on startup
- Everyone gets 503 → no healthy targets at all, maintenance mode stuck on, circuit breaker tripped
- Everyone gets 504 → upstream is alive but too slow (DB, downstream API)
- Some users get 401 → auth provider degraded, clock skew, token issuer down
- Some users get 403 → permissions issue specific to those users
- Some users get 429 → rate limit triggered (could be legitimate or attack)
- Mixed 5xx across endpoints → infrastructure issue (LB, network, region outage)
This is genuine SRE-grade thinking. Memorise the mappings.