Data model design
A model that fits how your network is actually organised — sites, roles, tenancy, circuits, services — rather than a stock schema you fight forever.
Foundation layer
A source of truth your automation — and your agent — can trust
Automation that reads from a stale spreadsheet does damage at machine speed. We build the structured, queryable record of what your network is supposed to be, and keep it honest.
Almost every failed network automation programme fails in the same place. Not the playbooks — the data. Teams script against an inventory nobody trusts, the first run touches the wrong device, and the programme loses its mandate.
A source of truth is not documentation. It is a structured, versioned, API-accessible model of intended state: what devices exist, what role each plays, which addresses and VLANs belong to which service, and what the configuration is supposed to look like.
It is also the thing that makes an agent useful rather than merely conversational. An agent can only tell you that running MTU is 1500 when intent says 9214 if intent is written down somewhere it can query.
Deliverables
What we build
01
02
NetBox or Nautobot buildout
Deployed, backed up, access-controlled and integrated with your identity provider. We will tell you honestly which of the two fits you better.
03
Discovery and reconciliation
Populating from the live network, then diffing against what people believed. The first reconciliation report is usually the most valuable artefact.
04
API and integration contracts
GraphQL and REST access patterns, dynamic inventory for Ansible and Nornir, and stable interfaces so downstream tooling does not break on schema changes.
05
Ownership and lifecycle
Who updates what, when, and how it is enforced. A source of truth with no owner is a spreadsheet with better fonts.
06
Drift reporting
Scheduled comparison of intended versus running state, surfaced as a report your team reviews and the agent can query during an incident.
Agent
What the agent does with this layer
This layer is what turns the agent from a log summariser into a diagnostician.
Intent vs. running
Comparing state to intent
The single highest-value query the agent makes. Most change-induced faults show up here first, minutes before a human notices.
Blast radius
Scoping the impact
Topology and role data let the agent say which services and which customers sit behind the failing device, not just which interface is down.
Correlation keys
Joining signals together
Consistent device names, roles and site codes are what let telemetry, logs and change records be joined at all. Without them, correlation is guesswork.
Stack
Tools we use here
NetBoxDCIM / IPAMNautobotextensible SoTGitversioned intentGraphQL / RESTaccess layerAnsible / Nornir inventorydynamic inventoryPythonreconciliation tooling
Questions
Questions about source of truth
Should we use NetBox or Nautobot?
Both are excellent and share ancestry. NetBox is the leaner, faster path if you mainly need authoritative DCIM and IPAM. Nautobot is the better fit when you want jobs, plugins and workflow logic living inside the source of truth itself. We recommend based on your team's Python appetite and how much custom workflow you expect, not on a house preference.
Our data is a mess. Is it too early to start?
No — messy data is the normal starting condition, and discovery plus reconciliation is designed for exactly that. We populate from the live network first and treat the gap between reality and belief as the project's first deliverable rather than an embarrassment to fix quietly.
Can we keep our existing CMDB?
Often yes. A CMDB and a network source of truth answer different questions, and we frequently integrate rather than replace. What matters is that one system is authoritative for network intended state and everything else syncs from it.
How long does a source-of-truth build take?
A focused build for a mid-size enterprise network typically runs six to twelve weeks to a trustworthy, automation-ready state. Scope is driven by device count, vendor spread and how much of the data has to be recovered from the network rather than imported.
Book a 30-minute automation readiness consultation
In 30 minutes, we’ll evaluate your infrastructure maturity, identify operational risk areas, and highlight high-impact automation opportunities.
No scripts. No invasive discovery. Just clarity.