Status: OUT
Compute substrate choice (AKS vs App Service) is architecturally second-order: the tier-governed triple constraint cascade bounds the achievable security, HA, and cost envelope, within which both substrates achieve equivalent defense-in-depth through the same underlying platform stack — making tier selection the first-order decision and substrate selection an implementation detail within it.