---
sourceDocument: Brazil ServiceNow AI Platform Capabilities
sourceDocumentLink: https://www.servicenow.com/docs/r/servicenow-platform

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil ServiceNow AI Platform Capabilities

ft:clusterId :

    - platcap

bundleId :

    - platcap

workflow :

    - Platform


---

# Domain separation

# Domain separation and CMDB Identification and Reconciliation {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 4 minutes to read
Summarize  
![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI  
This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.  

## Summary of Domain separation and CMDB Identification and Reconciliation

Domain separation in the CMDB Identification and Reconciliation (IRE) feature allows ServiceNow customers to logically segregate data, processes, and administrative tasks into distinct domains.
This separation controls user access and visibility to data based on domain affiliation.
Domain separation is fully supported and enforced within the IRE processes, ensuring that identification and reconciliation respect domain boundaries.
Show full answer Show less  

## How Domain Separation Works in IRE

Domain separation in IRE operates in two modes when the domain separation plugin is activated:

* **Strict mode (default):** IRE processes only Configuration Items (CIs) whose domain ID matches the logged-in user's domain. Duplicate CIs across different domains are not treated as duplicates.
* **Platform domain separation mode (optional):** When enabled via the `glide.identificationengine.platformdomainseparationenabled` system property, IRE follows platform domain separation rules. Parent domains can access CIs in child or visible domains, allowing cross-domain identification and reconciliation. This mode is intended for advanced use cases and carries risks such as increased detection of duplicate CIs and potential application failures if not carefully managed.

## Domain Separation during Identification

* Domain IDs are implicit in identification engine API calls and do not need to be explicitly sent.
* New CIs created during identification inherit the domain ID of the logged-in user.
* When updating CIs, the domain ID remains unchanged.
* De-duplication and reclassification tasks are created with domain IDs matching the related CIs.
* In strict mode, only CIs in the user's domain are matched; cross-domain duplicates are ignored.
* In platform domain separation mode, duplicates across parent and child domains are considered, allowing broader matching.

## Domain Separation and Identification Rules

Identification rules and inclusion rules are global and do not contain domain fields. This means they apply uniformly across all domains:

* Tables such as `cmdbidentifier`, `cmdbidentifierentry`, `cmdbrelatedentry`, and `cmdbieactiveconfig` do not have domain-specific fields.

## Domain Separation and Reconciliation Rules

Reconciliation rules can be domain-specific, allowing different reconciliation behavior per domain:

* Tables like `cmdbreconciliationdefinition`, `cmdbdatasourceprecedence`, and `cmdbdatasourcestaleness` include domain-related fields (`sysdomain`, `sysoverrides`, `sysdomainpath`).

## Practical Considerations for ServiceNow Customers

* Use strict mode by default to ensure domain isolation and avoid unexpected CI duplication issues.
* Enable platform domain separation mode only for advanced, specific use cases after careful assessment, as it may introduce risks and impact existing configurations.
* Understand that identification rules are global, so changes affect all domains uniformly.
* Customize reconciliation rules at the domain level to tailor reconciliation behavior per domain.
* Monitor duplicate CI detection closely when switching modes to manage potential application impacts.  
Domain separation is supported in the CMDB Identification and Reconciliation feature.
Domain separation enables you to separate data, processes, and administrative tasks into logical groupings called domains. You can control several aspects of this separation, including which users can see and access data.

## Overview of domain separation in IRE {#domain-separation-identification-reconciliation__section_pvf_wkx_vcb}

Domain separation is enforced during the [CMDB Identification and Reconciliation](https://www.servicenow.com/docs/sqNNkz3TEuCg6mpfcBg4OA "The Identification and Reconciliation module provides a centralized framework for identifying and reconciling data from different data sources. It helps maintain the integrity of the CMDB and some non-CMDB tables when multiple data sources are used to create and update CI records.") (IRE) process. IRE processes are domain aware and domain separation is applied to the Identification and Reconciliation
rules.

For more information about domain separation, see [domain separation](https://www.servicenow.com/docs/access?context=c_DomainSeparation&version=brazil&pubname=brazil-platform-security&ft:locale=en-US).

## How domain separation works in Identification and Reconciliation {#domain-separation-identification-reconciliation__section_ydt_kth_scb}

Domain separation in the identification engine is enforced when users activate the domain separation plugin. Domain separation for IRE has two modes of operation in domain separated instances:

* Strict mode (enabled by default): In this mode, identification processes only those CIs in which the domain ID is identical to the domain of the currently logged in user. If duplicate CIs exist across domains (including parent and child domains), then those CIs aren't considered duplicate CIs because their domain IDs don't match.
* Platform domain separation mode (disabled by default): In this mode, IRE follows the
  platform domain separation behavior. So during identification, parent domains can
  access all CIs within their child domains or any of the domains it has visibility
  into. For more information, see [Visibility domains and Contains
  domains](https://www.servicenow.com/docs/access?context=c_DomainVisibility&version=brazil&pubname=brazil-platform-security&ft:locale=en-US).

  Platform domain separation mode is intended to be used by advanced users for very
  specific or advanced use cases.  
  Note:  
  Platform domain separation mode introduces some risks that are greater on upgraded
  instances and much lesser on zBooted instances.

  Depending on how IRE processes are configured on a domain separated instance,
  setting IRE to use platform domain separation mode might result in unexpected and
  undesirable behavior if not used carefully. One of the risks is if enabling platform
  domain separation mode is followed by running IRE processes from a different domain
  than the one on which IRE processes were previously run. In this situation, CIs that
  were previously identified as unique, might get identified as duplicate CIs and
  might cause some applications to start failing.

  If any application is already using IRE effectively in domain separated
  environment, then there's no advantage in switching to platform domain separation
  mode that might create some risk.
{#domain-separation-identification-reconciliation__ul_hwt_gct_crb}

Use the [glide.identification_engine.platform_domain_separation_enabled](https://www.servicenow.com/docs/AY91c4KJgbxojkOwkv6EZQ "Use the Identification and Reconciliation properties to configure the Identification and Reconciliation Engine (IRE).") system property to
switch between those two modes for IRE domain separation. By default, this property is set
to false.

## Platform domain separation mode {#domain-separation-identification-reconciliation__section_y4c_w1n_crb}

Set the system property [glide.identification_engine.platform_domain_separation_enabled](https://www.servicenow.com/docs/AY91c4KJgbxojkOwkv6EZQ "Use the Identification and Reconciliation properties to configure the Identification and Reconciliation Engine (IRE).") to
true to enable the platform domain separation mode for IRE
processing. With the platform domain separation mode, parent domains can access all of their
child domains during IRE processing. For example, IRE can detect a matching CI in a child
domain and then update that CI instead of creating a new one.  
In the platform domain separation mode for IRE:

* IRE run from a parent domain can access CIs contained within their domain, child domains that are lower in the domain hierarchy, and global domain.
* IRE run from the global domain can access all CIs.
* [Visibility domains and Contains
  domains](https://www.servicenow.com/docs/access?context=c_DomainVisibility&version=brazil&pubname=brazil-platform-security&ft:locale=en-US) are supported.
{#domain-separation-identification-reconciliation__ul_lnv_ngn_crb}  
Note:  
When platform domain separation mode is enabled, there might be a sudden increase in IRE detection of duplicate CIs.

## Domain separation during the Identification Process {#domain-separation-identification-reconciliation__section_tzr_k3j_qdb}

Domain separation during the Identification process is enforced as follows:

* Regardless of the setting of the [glide.identification_engine.platform_domain_separation_enabled](https://www.servicenow.com/docs/AY91c4KJgbxojkOwkv6EZQ "Use the Identification and Reconciliation properties to configure the Identification and Reconciliation Engine (IRE).") system property:
  * Domain IDs don't need to be explicitly sent in the input payload of the identification engine APIs. Internally, the identification engine causes the current domain ID of the user to call the identification engine APIs.
  * During matching, if no records are found and a CI is inserted, the CI domain ID is the same as the domain ID of the logged-in user's domain. When updating a CI, the CI domain ID doesn't change.
  * During matching, if duplicates are found, De-Duplication tasks created in the \[reconcile_duplicate_task\] table have the same domain ID as of the duplicate CIs.
  * During matching, if reclassification of the CI isn't allowed, reclassification tasks are created in the \[reclassification_task\] table, with the same domain ID as the CI for which reclassification is needed.
  {#domain-separation-identification-reconciliation__ul_tkl_xjm_2rb}
* When the system property [glide.identification_engine.platform_domain_separation_enabled](https://www.servicenow.com/docs/AY91c4KJgbxojkOwkv6EZQ "Use the Identification and Reconciliation properties to configure the Identification and Reconciliation Engine (IRE).") is set to false:
  * Only CIs that have the same domain ID as the currently logged-in user's domain are used during matching.
  * Duplicate CIs that exist across domains (including parent and child domains) aren't considered as duplicate CIs by IRE.
  {#domain-separation-identification-reconciliation__ul_gnv_vfm_2rb}
* When the system property [glide.identification_engine.platform_domain_separation_enabled](https://www.servicenow.com/docs/AY91c4KJgbxojkOwkv6EZQ "Use the Identification and Reconciliation properties to configure the Identification and Reconciliation Engine (IRE).") is set to true:
  * Duplicate CIs that exist across domains (such as parent and child domains) are considered as duplicate CIs by IRE.
  * CIs from the logged in user domain and child domains are used during matching.
  {#domain-separation-identification-reconciliation__ul_stp_wdm_2rb}
{#domain-separation-identification-reconciliation__ul_dzt_z1h_ndb}

## Domain separation and Identification Rules {#domain-separation-identification-reconciliation__section_z1v_m3j_qdb}

The identification rules and identification inclusion rules used during the identification process are always defined at the global level. For example, the following tables don't have a sys_domain field:

* Identifier (cmdb_identifier)
* Identifier Entries (cmdb_identifier_entry)
* Related Entries (cmdb_related_entry)
* Identification Inclusion Rules (cmdb_ie_active_config)
{#domain-separation-identification-reconciliation__ul_bfm_pbh_ndb}

## Domain separation and Reconciliation Rules {#domain-separation-identification-reconciliation__section_bfw_n3j_qdb}

The reconciliation definition rules that are used during the reconciliation process can be defined for different domains. For example, the following tables do have sys_domain, sys_overrides, sys_domain_path fields:

* Reconciliation Definition (cmdb_reconciliation_definition)
* Datasource Precedence (cmdb_datasource_precedence)
* Data Source Staleness Definitions (cmdb_datasource_staleness)
{#domain-separation-identification-reconciliation__ul_nwg_b2h_ndb}