SUMMARY: A route substitution matrix compares each critical path with its realistic alternatives, including capacity, conversion work, activation authority, validation evidence, and time to useful service.
Lists of backup vendors and alternate channels create comfort without showing whether substitution can occur under pressure. The matrix turns that comfort into a testable claim.
Choose One Critical Movement
Start with a movement the organization must preserve: publishing an urgent notice, receiving a payment, authenticating a member, moving inventory, restoring a database, or transferring evidence to an independent custodian. Define the minimum acceptable volume and the maximum tolerable interruption.
Build the Columns
Primary route: record the provider, interface, credential, contract, jurisdiction, and people currently carrying the movement.
Substitute route: name a specific alternative. Avoid labels such as manual process or secondary vendor unless the actual account, endpoint, location, and owner are known.
Conversion burden: list every format change, identity check, data export, physical transfer, funding step, and counterparty approval required before traffic can move.
Usable capacity: estimate what proportion of the normal workload the route can carry after conversion. Record hard limits and assumptions separately.
Authority and custody: identify who can activate the substitute, who controls the necessary credentials, and how emergency approval will be evidenced afterward.
Validation signal: define the receipt, reconciliation, test transaction, checksum, or independent observation that proves the substitute is working correctly.
Test the Weakest Cell
Choose the alternative with the highest consequence and the least evidence. Run a bounded rehearsal that reaches the first validated unit of work. Measure recognition, authority, conversion, and confidence delays separately; their sum is the route’s actual fallback latency.
Use the dependency register to expose services shared by both routes. If the primary and substitute rely on the same identity provider, region, approver, or settlement layer, the matrix should mark them as a correlated failure rather than independent redundancy.
Operator rule: count a route as independent only after it has carried a validated unit of work without borrowing the failed path’s hidden dependencies.
Continue the discussion in the Clandestinia forum.