Your CMDB Is a Photograph. The Live System Is the Ontology.

Blog · IT Service Management

Your CMDB Is a Photograph of a System That's Already Changed.

By Prateek Chouhan7 min read

Short answer

A CMDB is reconstructed by discovery and reconciliation on a cadence — a periodically-refreshed picture of an estate that changed the moment the scan finished.

Every CIO has been sold the same promise: the CMDB is the trusted data foundation that makes change safe. Here is the part the pitch skips. Architecturally, a CMDB is a photograph — an image of your estate reconstructed by discovery and reconciliation on a schedule, already out of date the instant the scan finished. When your change-advisory board runs impact analysis against it, they are analyzing last week.

Let us concede the real strengths first, because the argument here does not need to overreach. A single unified configuration database genuinely beats a drawer full of spreadsheets and a dozen siloed inventories that never agree. ITIL-aligned change discipline — incident, problem, change, with a proper record of what was proposed and approved — is real operational value, not ceremony. A well-run CMDB genuinely helps you reason about impact before you touch production. And discovery itself is legitimately useful, especially across a brownfield estate that nobody fully documented and no single team fully controls.

The single-platform service-management leaders earned their position on exactly this ground. One data model in one place really does beat stitched-together point tools that each hold a fragment of the truth. That is not in dispute. The wedge is not unified versus siloed — the leaders already won that debate. The wedge is what a CMDB fundamentally is, no matter how unified the platform holding it.

A CMDB is not observed. It is reconstructed. Probes and sensors sweep the estate and emit raw signals; a normalization layer maps those signals onto configuration items; a reconciliation engine resolves conflicting sources into a single authoritative record. That pipeline runs on a cadence — nightly, weekly, or event-triggered — because it has to. It is a rebuild, and rebuilds have a clock.

Between two runs of that clock, the estate keeps moving. Someone resizes a cluster. A workflow provisions a resource. A certificate rotates. A dependency is added, retired, or repointed. The graph does not know until the next cycle catches up — and then only if the probe had reach, the mapping was right, and reconciliation picked the true source over the plausible one.

This is not a maturity problem you fix with better discovery. It is structural. Any system whose state is rebuilt from external observation carries a staleness window between observation and reality. Tighten the cadence as far as you like; the window narrows but never closes to zero — and the more dynamic the estate, the wider it effectively runs. Reconciliation adds a second gap on top of the first: when sources disagree, the CMDB does not record what is true. It records a decision about what is probably true. You are trusting a photograph that was also retouched.

The marquee use of all this is change-impact analysis. Before you approve a change, you trace the dependency graph to see what the change could touch. Sound in principle — and the whole point of paying for a CMDB.

But the dependency graph is the photograph. If the graph lags, your blast-radius calculation runs against relationships that may no longer hold: a dependency retired last Tuesday still shows on the map; one added this morning is invisible. The board approves a change against a topology that has already moved. The failure mode is quiet and expensive — the analysis looks rigorous, the graph looks authoritative, and the surprise arrives in production.

The AI layer now bolted onto these platforms does not close this gap; it makes the gap feel safer than it is. A confident, well-written recommendation summarizing a stale graph reads as most authoritative precisely when it is least grounded. Better summarization of last week is still last week. Deflecting a ticket or drafting an eloquent impact note is not the same as knowing the current shape of the estate you are about to change.

THE CMDB — A PHOTOGRAPH reconstructed on a cadence DISCOVER NORMALIZE RECONCILE CMDB GRAPHas of last scan STALENESS WINDOW live estate —already moved THE FABRIC — A LIVE ONTOLOGY state written by the execution DETERMINISTIC WORKFLOW change-control · inline gate CONNECTOR ONTOLOGY — live statethe state IS the record closed loop immutable per-action audit · no reconciliation · no staleness window

Now change the question. What if configuration state were never reconstructed at all — because the process that changed it wrote it?

On a composable process fabric, configuration and dependency state live in a Semantic Ontology, and the processes execute against that same ontology, in one runtime. When a Deterministic Workflow changes a resource — through a governed Connector, the only primitive permitted to touch an external system — the resulting state is written into the ontology as a byproduct of the action, at the moment of the action. There is no separate scan to go rediscover what the workflow just did. The change and the record of the change are the same act.

So an object's state is its current state, by construction — not because a scanner will catch up tonight, but because nothing changed it except the workflow that recorded the change. No discover-model-reconcile pipeline. No staleness window between observation and reality. No reconciliation guessing which of three disagreeing sources to believe, because there is one runtime and one write. The CMDB modules on Entroid — assets, dependencies, configuration — sit on that ontology. The CMDB is not a periodically-refreshed inventory beside the systems doing the work. It is the live operational substrate the work runs on.

This is emphatically not a claim that the fabric needs no integration. It runs over your existing estate through governed Connectors, and for any system the fabric does not execute against, you still learn its state the old way — by observing it. Discovery keeps its job on the brownfield edges nobody routes through a governed workflow. Conceding that is what keeps the rest of the argument credible.

The claim is narrower and sharper than "everything is always live." It is this: for every resource a governed workflow changes, that resource's state is current by construction, because the change and the record are one action. The staleness window is not tightened — for the executed path, it is eliminated at the source, because there is no gap between doing and recording to leave open.

Reframe change management on that footing and the mechanics shift underneath you:

  • Impact analysis becomes a query over live state, not a trace over a reconciled snapshot. The dependency you see is the dependency that exists, because the last workflow to touch it wrote it.
  • Change-control stops being a gate you clear before handing work to another system. It is an approval enforced inline — segregation of duties, thresholds, human-in-the-loop where the design calls for it — inside the very workflow that performs the change, at the moment of the action.
  • The loop closes. Propose, govern, execute, and the resulting state is the record. There is no drift between what was approved, what was done, and what the CMDB believes, because those are no longer three separate artifacts kept in sync by a reconciliation job.

Consider it illustratively — a hypothetical, not a delivered result. A change resizes a dependency-heavy service. Against a photograph, you approve on last week's graph and hope the reconciliation ran clean. On the fabric, the impact query reads live dependencies, the change-control gate fires inline, the Connector performs the change, and the new topology is written the instant it exists — with an immutable per-action record of exactly what changed and who authorized it. That contrast is a property of the architecture, not a case study. It holds because of how the primitives are wired, regardless of any vendor's roadmap.

Here is the honest line that separates the two worlds. A workflow that routes a change request, and an automation that drives another system to make the change, is orchestration across systems the platform does not own — and its picture of the result is only as fresh as the next scan. Making the process the execution fabric means the fix is a governed action and the new state is the same object you just wrote. Record, route, summarize, and recommend are all valuable. They are also not the same as execute-and-know.

You cannot make safe changes to a live system by studying its photograph.

See what this looks like for your enterprise.

Not a demo. A strategic conversation about how your enterprise could operate
when every process runs on one governed fabric.

Start the Conversation