Model Serving SLO Design for Enterprise LLM Traffic

Quick Answer: Model serving SLO design picks a small set of SLIs, a time window, and an error budget for live LLM traffic, then names who stops deploys when the budget burns. It is an operations target. It is not a vendor uptime clause.

A model serving SLO is a written reliability target that says what share of production requests must meet named service indicators over a stated window so on-call and product can share one error budget. If the indicator is not on the serving path, it is not a serving SLO.

This page designs that target. It is not an uptime-SLA buyer’s guide and not a glossary of first-token versus per-token terms. Those pages answer contracts and definitions. This page answers what you page on.

Which SLIs belong in a serving SLO?

Start with availability plus one latency SLI on one traffic class. A second class (long context, batch extract) gets its own SLO or it will steal the budget. Do not put GPU SM% in the SLO. Device utilization is a diagnostic, not a user promise.

Name the tokenizer, max context, and caller set in the SLI. A mix that silently shifts toward long prompts will burn a latency target that still looks “the same.” OnePlus Platform, OneSource Cloud's AI orchestration platform, can separate services and quotas so classes do not share one histogram.

How do window and error budget change behavior?

Pick a window you can act inside: 28 days is common; 7 days is better while the fleet is new. The error budget is one minus the SLO. When the budget is gone, you freeze risky deploys and fix serving, not features.

Write the freeze in advance. A budget that never changes a release calendar is a dashboard. Page on burn rate, not only on a hard miss. A slow leak over five days is how most chat fleets die without a single dramatic outage.

Batch jobs should not share the interactive budget. A nightly eval that times out is an eval incident. It is not permission to miss chat. Split the SLOs or split the endpoints.

What is not a serving SLO?

A vendor uptime percentage on the hall is an SLA conversation. It may feed your availability SLI, but it is not your SLO. Your SLO includes application 5xx, model OOM, and queue drops the vendor will call “customer configuration.”

A glossary of latency components is useful for debugging. It is not an SLO unless you pick one indicator and a percentile. Do not list five latency names and call that a design.

Shared GPUs add variance you do not control. If the SLO is tight, move that class to exclusive cards. Private AI infrastructure is a tenancy decision that can shrink neighbor noise. It does not write the percentile. U.S. halls, including Texas / Richardson exclusive capacity, still need the same SLI text.

Who owns the budget?

Product owns whether the target matches the user promise. Platform owns measurement and the freeze. Model owners own quality-gate SLIs. Finance does not own the SLO. Finance owns the card count once the SLO exists.

If the budget burns every week, you undersized headroom or failover, or you promised a class you cannot serve. Do not quietly loosen the percentile in the dashboard. Change the written SLO or change the fleet. Managed AI infrastructure can watch burn. Someone still signs the freeze.

FAQ

Is a serving SLO the same as an uptime SLA?

No. An SLA is a commercial commitment, often on infrastructure availability. An SLO is an internal target on user-facing requests, including application failures. You can meet a hall SLA and miss a serving SLO on model errors.

How many SLOs should one model have?

One availability SLO and at most two latency or quality SLOs per traffic class. More than that and on-call will ignore the set. Add a class, do not add a sixth indicator on the same class.

Should we SLO tokens per second?

Not as the primary user SLO. Tokens per second is a capacity diagnostic. Users feel completed good requests and wait time. Use throughput in capacity planning. Use request success and latency in the SLO.

Do dedicated GPUs let us skip error budgets?

No. Exclusive cards remove some noisy-neighbor burn. They do not remove bad releases, OOMs, or cold starts. OneSource Cloud can host the exclusive pool. You still name the window and the freeze.

What happens when the budget hits zero?

Freeze non-emergency deploys, stop prompt experiments that change latency shape, and restore the SLI. If product refuses the freeze, they are choosing a different SLO. Write that down. Do not keep two unofficial targets.

Summary

Model serving SLO design names a few SLIs, a window, and an error budget for real LLM traffic. It is not a vendor SLA and not a latency glossary. Split classes. Freeze when the budget burns.

Measure on the serving path. Explore OneSource Cloud’s private AI infrastructure when a tight SLO cannot share a GPU with another tenant’s job.