Incirova ITSM Pilot
AI-assisted ServiceNow incident investigation and verified resolution. Grounded in your engineering runbooks through hybrid semantic and lexical retrieval, with mandatory human confirmation before any ticket updates are applied.
1. Grounded Runbook Retrieval
Upload troubleshooting guides, standard operating procedures, and runbook PDFs into an isolated workspace. Incirova indexes and retrieves relevant passages using dense semantic vectors and lexical BM25 ranking with Reciprocal-Rank Fusion (RRF).
2. Explicit Human Review
The system never updates or resolves ServiceNow tickets autonomously. Every recommendation generates a single-use, time-bounded resolution plan that requires an engineer to review the evidence and explicitly confirm the action.
3. Multi-Tenant Workspace Isolation
Teams operate in logically isolated workspaces. ServiceNow credentials, AI provider keys, uploaded documents, vector indices, and investigation logs are partitioned with strict tenant boundaries.
How Incirova Investigates ServiceNow Incidents
-
Ticket Context Retrieval: Connect to ServiceNow over HTTPS REST Table API. Incirova reads incident summary, description, category, state, priority, and the optimistic concurrency token (
sys_mod_count). - Relevant Runbook Matching: The incident symptoms are searched against your uploaded runbook library using hybrid dense vector search and BM25 lexical ranking. Reciprocal-Rank Fusion compiles the most relevant passages with exact document and page citations.
- Evidence-Backed Recommendation: Your configured AI provider evaluates the symptoms against cited runbook instructions. It generates a clear root-cause hypothesis, step-by-step resolution steps, and proposed close notes.
- Single-Use Resolution Plan: When an investigation matches documented recovery steps with high confidence, Incirova creates a time-bounded resolution plan containing exact field diffs and close codes.
- Human Review and Concurrency Check: An IT engineer reviews the cited runbook passages and proposed notes. Upon confirmation, the backend checks that the incident was not modified by another user concurrently, applies the update to ServiceNow, and verifies the resulting state.
Safety Safeguards and Security Controls
AES-256 Credential Encryption
ServiceNow account credentials and model provider API keys are encrypted at rest using AES-128-CBC with HMAC-SHA256 authentication. Plaintext credentials are never exposed in browser API responses.
Server-Side Token Verification
Every protected backend endpoint verifies the Firebase ID token cryptographically using server-side validation. Client-supplied user identities or unverified tokens are rejected.
Optimistic Concurrency Protection
If an incident is modified by another engineer while investigation is underway, the ServiceNow concurrency token changes, and Incirova halts the write operation to prevent overwriting recent updates.
Post-Update Verification
Sending an update request is not assumed to be successful. The system performs a follow-up query to confirm the incident reached the intended state before reporting success to the operator.
System Specifications
| Supported ITSM Platform | ServiceNow REST Table API (HTTPS with basic authentication or service account) |
| Supported AI Providers | OpenAI (GPT-4.1-mini), Google Gemini (Gemini 2.5 Flash), Azure OpenAI Service, or HTTP Model Endpoint |
| Retrieval Architecture | Hybrid dense vector search (Chroma) and BM25 lexical ranking with Reciprocal-Rank Fusion (RRF) |
| Authentication and Identity | Firebase Web Authentication with server-side Firebase Admin token verification |
| Tenant Data Partitioning | Workspace-level isolation with database foreign keys, scoped vector stores, and private document storage |
Evaluate Evidence-Backed ServiceNow Incident Investigation
Connect a non-production ServiceNow developer instance and upload standard operating runbooks to evaluate grounded recommendations and human approval workflows.