Concepts

Uncertainty & failure modes

A system of record earns trust by how it behaves when things are unclear or wrong, not when they're easy. ServiceMatch has one consistent answer across every failure class: degrade to visibility, never to silence. Nothing is dropped quietly, defaulted quietly, or confirmed hopefully.

What happens when…

Situation	Behavior
A device can’t be reliably identified	Blocked from import with the specific reason stated (BLOCKED_* status). Visible in the disposition report; never imported hopefully.
Identities conflict across sources	One-serial-many-hosts and one-host-many-serials are flagged for human review with the evidence. Never silently merged.
No classification rule fits with confidence	The record routes to a review queue with its evidence — including matches against banned abstract classes, which are caught at runtime rather than written.
Service-placement evidence is weak or conflicting	The placement stays pending, visible, and waiting for a person. Contradictory evidence lowers confidence rather than being averaged away; both sides stay inspectable.
A source file arrives malformed, duplicated, or schema-drifted	Intake validation quarantines the file (a real quarantine directory, per source) and logs an intake event. The pipeline runs on what passed validation.
The AI layer is unreachable	The deterministic pipeline keeps running — processing, review surfaces, and exports all work. Authoring assistance pauses until connectivity returns.

The override lifecycle

An operator override is a recorded decision, not an edit: it takes precedence over the automated result and survives pipeline re-runs.
The decision it beats is not deleted — both stay visible, in order, attributable.
Overrides feed back: every confirm and reject becomes a calibration label held in your environment, hardening the engine’s release gate.

Versioning & rollback posture

Every export carries a manifest of the configuration and decisions that produced it; input fingerprints and rule-version hashes are recorded in export history. Two exports can always be compared and explained.
The pipeline is deterministic: the same inputs and configuration produce the same outputs — which is also how engine changes are regression-verified before shipping.
Instance deployment ships as native ServiceNow update sets, so the instance-side back-out path is the platform’s own, not a proprietary mechanism.
ServiceMatch configuration is decisions, not state: any rule, precedence choice, or placement can be revised through the governed path, on the record.

Design Principle

Failure modes are product surface, not exception handling. A blocked record with a stated reason, a quarantined file with a logged event, and a pending placement waiting for review are the system working — the failure would be any of them happening silently.