cmdb_ci_service vs cmdb_ci_business_app — where the boundary actually is

These two get conflated because both feel like “the application”, and ServiceNow’s own labelling has not helped — the class names and the diagrams have drifted apart more than once.

The boundary holds if you stop asking what the record is and ask what question it exists to answer.

cmdb_ci_business_app answers portfolio questions. What do we own, who owns it, what does it cost, what lifecycle stage is it in, should we keep funding it. It is the anchor an architect and a finance team argue over. It does not run anywhere.

cmdb_ci_service and its descendants answer operational questions. What is consuming this, what breaks if it stops, who gets paged. These are the records incidents and changes attach to.

A business application is realised by one or more services. The business application “Workday” is a portfolio entry; the thing that goes down on a Tuesday is a service beneath it, probably one per environment.

The symptom that tells you it has gone wrong

Incidents attached to business applications.

It looks harmless and it quietly destroys both sides. The portfolio record accumulates operational noise, so it stops being a clean answer to “what do we own”. And the operational record never gets exercised, so its relationships stay thin and impact analysis stays useless. Six months later someone proposes rebuilding the CMDB.

The second symptom: a business application per environment. If you have “Workday Dev”, “Workday Test” and “Workday Prod” as business applications, the portfolio now has three things to fund where the business has one. Environments belong below, not above.

Where it gets genuinely hard

Software-as-a-service with nothing to discover. There is no host, no process, no port — so the operational layer has nothing underneath it, and the temptation is to skip it and hang everything off the business application.

Resist it anyway, and model the service even though it is thin. The moment that SaaS platform has an outage, you want somewhere for the incident to land that is not the funding record, and you want the integration dependencies to hang off something operational.

The honest caveat

Both placements are judgments. Two competent implementers will draw this boundary slightly differently and both will be defensible. What matters is less which convention you pick than that the convention is written down and that someone can see, a year later, which one was applied and why.

The whole model, and where its language contradicts itself, the CSDM model documentation walks through it.