Phil Karlton’s joke about cache invalidation survives because most teams own exactly one purge button and one strategy: panic. Production estates deserve a taxonomy, because the mechanisms differ in blast radius, speed and origin consequences, and matching mechanism to content class is the entire craft.
The mechanism taxonomy
Hard purge deletes: next request is a full miss, origin pays immediately. Soft purge marks stale: next request serves the old object while revalidating in background, zero user latency, gentle origin ramp, the default you should reach for. Tag-based (surrogate-key) purging invalidates by label, everything tagged product-123, across arbitrarily many URLs in one call, which is the only sane mechanism once URLs and content decouple. And versioned URLs sidestep invalidation entirely: fingerprinted assets never purge, they get abandoned.
Blast radius engineering
The scary purges are the wide ones: full-catalog, path-wildcard, everything. Wide hard purges are self-inflicted stampedes (our coalescing article’s pathology); wide soft purges are usually survivable but still synchronize revalidation load. Discipline: stage wide invalidations, jitter them, prefer soft, and require a second approver for anything wildcard, the same ceremony you give destructive database operations, because that is what it is.
The tagging discipline deserves its own paragraph because it is where estates succeed or drift: tags are an ontology, and ontologies rot without ownership. The pattern that survives: tags mirror your domain model (entity-type:id, plus coarse rollups like template:product), emitted by the publishing pipeline rather than hand-attached, documented in one page, and capped in cardinality per object (vendors have limits, and taste has lower ones). Estates with clean tag ontologies invalidate precisely and calmly; estates without them rediscover wildcard purges under deadline, which is how the stampede stories in our incident reviews usually begin. The ontology is the invalidation strategy; everything else is plumbing.
Speed and verification
Purge propagation ranges from sub-second to minutes across vendors, and the difference matters exactly during corrections: wrong price, legal takedown, leaked object. Know your provider’s figure, verify it empirically (purge, then poll from multiple regions), and know the escalation path for must-be-gone-now content. Tag purges sometimes propagate differently than URL purges; test both.
In practice
Map content classes to mechanisms: fingerprinted static never purges; HTML and APIs soft-purge by tag on publish events; emergency removals hard-purge with verification polling; catalogs re-tag rather than re-purge. Wire publish systems to emit tags automatically, put purge volume and latency on a dashboard, and rehearse the emergency path quarterly. Invalidation stops being hard when it stops being one button.
Cache-invalidation design is a standing module in our engineering engagements: taxonomy, tag ontology, emergency runbook.