The Binding Constraint Is Watts: Choosing Where Workloads Live When Connection Dates Slip

Ask a UK infrastructure team what determines where a workload runs and, for two decades, the answer has been latency. Ask the same question in 2026 and the answer is more often a connection date, a contracted capacity figure, or a letter from a distribution network operator explaining that the substation has no headroom until the early 2030s.

That shift has consequences well beyond the facilities plan. When power availability rather than round-trip time is the binding constraint, workloads move on someone else's timetable, sometimes at short notice, sometimes in both directions. Network architecture that was designed on the assumption of stable placement will be tested continuously. Zero trust is the property that makes placement reversible.

What changed in the UK market

The last two years have reorganised the supply side. Queue reform administered through the National Energy System Operator has moved the connection process towards a readiness-based order rather than a first-come, first-served one, and a technical limits arrangement has allowed some transmission-connected projects to connect earlier in exchange for accepting curtailment. Both changes are sensible. Both also mean that the date a business is given is a moving quantity, not a promise.

Meanwhile the areas with the deepest fibre — West London, the M4 corridor, parts of Greater Manchester and the Edinburgh fringe — are frequently the same areas with the least spare capacity. The result, for a UK technology leader, is a planning environment where the cheapest and the most resilient answer are rarely the same answer, and where the estate may legitimately be split across a colocation cage, a hyperscaler region and a refurbished room in a building the company already owns.

Three composite cases

The manufacturer that brought the forecasting model home. A Greater Manchester manufacturer wanted to repatriate a scheduling workload from a public cloud region, largely on cost grounds. The colocation slot it wanted was not available until 2028. It moved the workload into an existing plant room instead, on the condition that access was governed by the same conditional-access policy as the cloud tenant. Because both environments authenticated against the same directory and the workload carried a cryptographic identity, the move took eleven days rather than eleven weeks.

The colocation provider with a waiting list. A Midlands provider could not offer new customers full contracted power. It began selling partial allocations with a documented curtailment regime. Customers who had designed workload priority tiers in advance accepted this; customers who had not discovered, during the first test, that their backup platform drew the same feed as their primary.

The retailer that stayed put. A retail group with a primary site in the constrained western corridor concluded that relocation was not achievable inside three years. It invested instead in degraded-mode design: defining what must remain available at sixty per cent power, testing it quarterly, and narrowing access policy during those windows rather than disabling it.

None of these is a heroic case. Each is an ordinary placement decision made under a constraint that did not exist when the original architecture was drawn.

Identity-aware routing as a placement primitive

Traditional routing is topological: traffic goes where the subnet is. Identity-aware routing decouples the two. A service presents a workload identity, the network evaluates that identity against policy and posture, and the connection is allowed to the instance that currently satisfies the rule — regardless of which building that instance occupies.

The practical benefit is that relocation stops being a network project. When a workload must move because a feed is constrained, the policy does not need rewriting; the identity stays constant while the address changes. Mutual TLS between services, short-lived credentials and a workload identity framework are the enabling components, and most UK enterprises already have them in some form, usually in the Kubernetes estate and rarely anywhere else.

Move segments, not servers

The unit of relocation should be the segment, not the machine. This has two advantages. First, blast radius becomes a scheduling constraint: nothing larger than a defined threshold may sit on a single power feed, which forces segmentation decisions that security teams have been requesting for years. Second, a segment boundary is a natural place to record evidence — what moved, when, under whose approval, and what policy applied before and after.

In practice, the segmentation model that supports resilience and the one that supports zero trust are the same model. Power failure domains and trust boundaries should be drawn to coincide wherever possible, so that a curtailment event does not create an inadvertent trust shortcut.

Designing for the brownout, not the blackout

Outage planning is well understood in UK data centres — generators, UPS runtime, annual load-bank tests. The harder scenario is the partial one: capacity reduced by a third for an afternoon, or a contracted allocation trimmed at short notice, with every system technically alive and none of them healthy.

Three design moves help.

• Tier the estate explicitly. Tier one comprises obligations that cannot lapse: safety systems, regulatory reporting, payment authorisation, clinical or statutory records. Tier two is commercially important and runs while power permits. Tier three is interruptible batch work, and it should be interruptible by design rather than by accident.
• Express degraded mode in policy, not in a runbook alone. If only a subset of staff should reach tier-one systems during a curtailment, that is an access policy change, not a verbal instruction. Narrowing access is far better than denying it.
• Test the reduction. Quarterly tests at reduced capacity reveal the shared-feed dependencies that diagrams hide, and they produce the evidence that assurance functions will otherwise have to reconstruct during an incident.

The placement decision as a risk record

Every placement decision should leave a short, board-readable record: power availability and contract term, failure domains and feed diversity, degraded-mode test result, dependency map, and a review date. Six fields, owned by a named individual, reviewed annually or on any material change.

This is where resilience and assurance meet. An estate that can demonstrate it has tested its constrained-power posture is in a materially different position from one that can only demonstrate a business continuity plan written before the constraint existed. For UK organisations in scope for sector regulation — energy, water, health, digital infrastructure — that record is increasingly the difference between a comfortable conversation with a regulator and an uncomfortable one.

Designing for the step change

Latency optimisation is a continuous exercise: you tune, you measure, you tune again. Power availability moves in steps, and steps are harder to architect around because they arrive without warning. The organisations that will cope best over the remainder of the decade are not those that guessed the right location. They are those that built an estate where location is a policy outcome rather than an architectural assumption — and where the decision to move, or to stay, is documented well enough to defend.

In a network that pushes constantly towards disorder, that discipline is the whole point.