Availability zone (independent failure domain)
An AZ is a separate building (or hall) with its own power and its own network. The whole point is independence: if one AZ burns down, floods, or loses power, the other one keeps running because it shares nothing with the first. It is the unit of "how much can fail at once."
Customers pay more to be deployed across two AZs at once, because a copy in each means no single building taking a hit can take them offline. Premium and regulated tenants frequently require it at onboarding — for them, a single-AZ deployment simply is not allowed to carry the workload.
Detailed explanation
An AZ is a failure domain with independent power, cooling, and network fabric. Inter-AZ latency is on the order of 0.5-2ms (not modeled yet). Multi-AZ products distribute replicas across AZs so a single AZ outage never takes both copies; a single-AZ deployment cannot mathematically promise 99.99%.
Premium customers (Enterprise, HyperBigCo, regulated SaaS) require multi-AZ at onboarding and the engine pre-checks it before accepting the prospect. An AZ sits inside a region; cross-region is the next failure-domain boundary up, with its own much larger latency and no automatic inter-region failover under it.