Another way to limit fault from spreading is taken straight from the stockyards. When building ships, you usually don't want the ship to get full of water if a hole breaks in the hull. To limit the damage of such holes, you would partition the hull into bulkheads, each of which would be easy to isolate. In this case, only the damaged bulkhead would get filled with water.
The same principle applies to limiting the fault impact in software architecture. You can partition your instances into groups, and you can assign the resources they use into groups as well. Setting quotas can also be considered an example of this pattern.
Separate bulkheads can be created for different groups of users, which can be useful if you need to prioritize them or provide a different level of service to your critical consumers.
