Infrastructure data arrives incomplete, duplicated, and inconsistent more often than anyone would like. Before it can safely enter the CMDB, engineers spend hours manually reviewing and correcting it, checking for duplicate identities, missing owners, and relationships that never got recorded.
Keystone, built by Alex Ngo and Nivetha Sivakumar for KeenStack’s internal StackUp hackathon, turns that manual review into a governed pipeline. It’s an AI agent that understands infrastructure data quality, prioritizes the fixes that matter most, and executes updates through ServiceNow’s Identification and Reconciliation Engine (IRE), the same engine that already governs how CIs get created and matched in your CMDB. AI prepares the work. Engineers approve the change.
How it works
Keystone runs on a model the team calls CPR: Comprehend, Prioritize, Remediate. In Comprehend, the agent classifies every staged record and applies a confidence gate, clearing the records it’s confident about and holding the rest for human review. It also evaluates how incoming records will be identified by the CMDB. When existing IRE rules are not sufficient to reliably distinguish a class of CIs, Keystone can surface the gap and propose new identifiers or changes to the IRE used for that data.
In Prioritize, it creates workgroups of problematic CIs and ranks it by impact to show how much each one would move the CMDB’s overall health score, so engineers see the highest impact work first instead of a flat list. In Remediate, approved fixes execute through ServiceNow IRE, which is the only path Keystone ever writes through. This means Keystone isn’t only correcting the current dataset, it can improve the rules that govern how future infrastructure data enters the CMDB.
Nothing commits to the CMDB without a deliberate approval step. Every batch of changes gets frozen into an exact packet, confirmed against its own hash, and authorized once, a one-time authorization that’s consumed the moment an engineer approves it. Once committed, Keystone reads the result back from ServiceNow to confirm the change actually landed the way it was proposed.
Why it matters
The manual alternative to this is familiar to anyone who has cleaned up a CMDB: hours spent tracing which of two similar-looking servers is the real one, or chasing down who actually owns an orphaned CI, or even . Keystone’s team estimates the platform can automate roughly 80 percent of that repetitive review work, which is what turns CMDB cleanup from a standing chore into something that runs continuously in the background.
The part worth paying attention to is what stays a human decision. Engineers only review the high-impact calls, like which of many records should survive a duplicate merge, while Keystone handles the mechanical work of finding, classifying, and packaging the fix. Every approved update is independently verified through IRE and read back from the CMDB, so trust in the data increases rather than eroding as more of the pipeline gets automated. That combination, bounded autonomy plus independent verification, is also what lets the same pattern extend from a pilot dataset to an enterprise-scale migration without the risk scaling up alongside it.
What the pilot showed
Against a sample migration dataset, Keystone reduced roughly 600 staged infrastructure records down to 545 distinct identities, flagging 55 likely duplicates for a human to confirm before merging. Running its confidence gate, it cleared the majority of records automatically while holding just under a fifth for manual review. Ranking the remaining issues moved the dataset’s overall CMDB health score from a baseline of 88 toward a projected 97, with resolving duplicate identities identified as the single highest-impact fix available. Once approved, 384 records committed through IRE with a 100 percent read-back verification rate and zero direct writes outside that path.
Keystone is one way to bring order to a messy CMDB. If yours could use the same treatment, reach out to KeenStack.
Built by:
Alex Ngo
ServiceNow Developer
Nivetha Sivakumar
Software Engineer