Architecture May 2026
Systems of record are separating from systems of intelligence. Orchestration is becoming the new layer. What's real, what's emerging, and what your foundation has to do for any of it to work.
Most ITSM environments today are built around tools. ServiceNow, Halo, Freshservice, Zendesk, each one owns its workflows, its automation, its logic, its AI. The architecture of the next decade puts intelligence somewhere else entirely.
What does the future ITSM AI architecture look like?
The emerging ITSM AI architecture separates systems of record (incident data, knowledge bases, CMDBs, tools like ServiceNow and Halo) from systems of intelligence (LLMs and AI agents), with an orchestration layer between them coordinating workflows across multiple platforms. The interface layer, chat, copilots, embedded AI, sits on top. The shift moves complexity out of the ITSM tool and into the orchestration and intelligence layers above it. Standards like the Model Context Protocol (MCP) and Agent-to-Agent (A2A) protocol are the connective tissue making this architecture practical.
The ITSM environments most teams operate today are tool-centric by design. The platform, ServiceNow, Halo, Freshservice, whichever, is the boundary of the system. Workflows live inside it. Automation lives inside it. AI features, when they exist, are bolted onto it. Integration with other systems happens through point-to-point connectors that each have to be built, maintained, and watched. The result is operational coherence inside any single tool and growing complexity at the edges where tools meet.
This worked, mostly, for two decades. It produced predictable software, predictable workflows, and predictable governance. The price was duplication, fragmented automation, and AI capabilities that stop at the edge of whatever platform produced them. A team running ServiceNow ITSM, Jira for development, and Zendesk for customer service has three AI surfaces that don't talk to each other, three systems each guessing at context the others hold. That arrangement is what the next architectural shift is built to fix.
The emerging architecture separates the what from the how. ITSM tools remain, they aren't going anywhere. They keep doing what they're good at: storing incidents, requests, assets, knowledge. But they stop being where the logic lives. The intelligence layer moves above the tool, where it can see across multiple systems and reason about a situation that spans them. The orchestration layer connects the intelligence to the tools, executing actions in the right system at the right time. The interface layer, increasingly chat, voice, and embedded copilots, replaces the tool's own UI as the primary place users interact.
The shift is genuine and it's already underway. Anthropic's Model Context Protocol (MCP) is becoming the standard for AI agents to access external tools and data. Agent-to-Agent (A2A) protocols are emerging for inter-agent communication, with ServiceNow shipping A2A in their AI Agent Fabric and Google Cloud's Gemini Enterprise adopting both. What's been theoretical for several years now has shipping vendor support. That doesn't mean the architecture is fully realised, it isn't, but it means the foundations under it are real, not aspirational.
The four-layer architecture
Interface Layer
where users interact
Systems of Intelligence
the reasoning layer
Orchestration Layer
the execution layer
Systems of Record
the source of truth
The four-layer architecture, with the foundation layer that determines whether any of it delivers.
Each layer in the new stack does a specific job. Each can be specified, measured, and replaced independently. The architectural value is in the separation, when intelligence is decoupled from any single tool, it can reason across all of them.
1 Systems of Record
These don't go away. ITSM tools, CMDBs, knowledge bases, and asset registers remain the source of truth for the data the AI reasons over. Their job narrows: they store the canonical record of incidents, configuration, and resolutions, and they expose that data through stable APIs to the layers above. Investment in these systems still matters, they have to hold accurate, consistent, well-structured data, but they stop being the place where the workflow logic lives.
ServiceNow ITSM, Halo, Freshservice, Zendesk, TOPdesk all expose data via APIs. CMDB and knowledge platforms are mature.
Genuinely standardised data models across vendors. Most exports remain platform-shaped.
2 Systems of Intelligence
This is the new core. Powered by foundation models from Anthropic, OpenAI, Google, and others, this layer handles reasoning, summarisation, decision-making, and context interpretation. In practice, most ITSM customers don't access these models directly, they consume them through their vendor's AI features (Now Assist, Halo's AI suite, Freddy AI). The intelligence layer is real; whether the customer interacts with it directly depends on whether they use vendor AI or build custom AI infrastructure.
Vendor AI features are mature and shipping. Direct LLM integration via APIs is straightforward.
The discipline of consistently tuning, monitoring, and governing intelligence-layer behaviour at enterprise scale.
3 Orchestration Layer
This is where the architectural shift is most visible. The orchestration layer connects systems together, executes workflows, and coordinates actions across tools. The Model Context Protocol (MCP) has become the leading standard for AI agents to access external systems. Agent-to-Agent (A2A) protocols are emerging for inter-agent communication. Vendors are shipping orchestration runtimes, ServiceNow's AI Agent Fabric is the most mature example, embedding both MCP and A2A.
MCP is shipping in production. ServiceNow's AI Agent Fabric is generally available. Google Cloud and ServiceNow announced cross-platform A2A interoperability in April 2026.
Genuine multi-vendor orchestration at scale. Most production deployments are still single-vendor.
4 Interface Layer
Users increasingly don't interact with tools directly. They interact with chat, voice agents, copilots embedded in the tools they already use (Slack, Teams, browsers). The interface layer abstracts away the underlying platform. A user might ask "what's the status of last week's database incident" and get an answer that drew from the ITSM tool, the CMDB, the monitoring system, and the knowledge base, without knowing or caring which one held what.
ServiceNow's AI Experience (AIx), Microsoft Copilot integrations, embedded chat agents.
The cross-platform unified interface that genuinely abstracts the user away from any specific tool. Most interfaces today are still vendor-specific.
Architectural diagrams are easier to draw than to operate. Here's how the four layers actually behave during a single end-to-end interaction in an environment where the architecture is functioning as designed.
A user reports an issue through their company chat, "the finance app is running slowly for our team this morning." The interface layer routes that message to an AI agent. The intelligence layer parses the request and recognises three things: it's an incident, it affects multiple users, and it relates to a specific application. The orchestration layer then takes a series of actions: it creates an incident record in the ITSM tool, queries the monitoring system for performance data, checks the knowledge base for known issues with this application, and identifies the team responsible for it from the CMDB. The intelligence layer synthesises what it found and posts an interim response back to the user, "a database performance issue is affecting the finance app, the team is investigating, ETA 30 minutes", while the orchestration layer creates a parallel task in the dev tracking system for the team that owns the application. The user never switches tools. The team responsible never has to chase context across systems. When the issue resolves, the AI closes the loop in all systems simultaneously and updates the user.
This isn't science fiction, every component above ships in production today. What's rare is having all of them work together coherently, in a single environment, on data clean enough for the AI to navigate without human correction at every step. Which is the entire point of the article.
The architecture is real. The technology ships. What determines whether it delivers value at any specific organisation is what sits underneath the four layers, the foundation that no vendor ships. The architecture amplifies whatever it's built on. Strong foundation, the architecture compounds value. Weak foundation, the architecture compounds noise, and faster.
Break 01
When categories differ between systems, fields don't align, and ticket history is messy, the AI cannot reliably orchestrate. It can pull data from three systems and produce three contradictory readings of the same incident. Cross-system orchestration depends on cross-system data coherence, which most enterprises don't have today.
Break 02
When knowledge is duplicated across tools, inconsistent in format, or outdated, AI responses degrade immediately. The orchestration layer can route a query to the right knowledge source; it cannot make that source useful if its content is stale or contradictory. Knowledge fragmentation is the most common failure mode in cross-platform AI deployment.
Break 03
Different tools use different states, different process steps, different ownership models. The orchestration layer has to reconcile these in real time, and often does so imperfectly. An AI agent that closes a ticket in ServiceNow when the corresponding Jira issue is still open creates a state inconsistency that propagates downstream. Reconciliation logic is a major source of orchestration brittleness.
Break 04
AI agents take actions and trigger workflows. Without governance, visibility into what agents are doing, why, on whose authority, errors scale across systems faster than humans can detect them. The AI Control Tower pattern (a unified registry of every agent and action) is emerging as the answer, but it's still maturing. Most enterprises don't have it yet.
The architecture's promise is real, but its preconditions are unglamorous. It depends on three things that most ITSM environments don't have today: a unified-or-near-unified data model with aligned categories and consistent fields, a high-quality knowledge layer with structured content and named ownership, and workflow standardisation that maps states across tools with consistent ownership. None of these is sexy. All of them are years of work. None of them ship in any vendor licence.
This is the work that the next eighteen months will sort organisations into two groups. The first group is treating data quality, knowledge maintenance, and workflow standardisation as the prerequisite, investing in those before AI orchestration features arrive in their procurement cycle. The second group is buying the orchestration platforms first and addressing the foundation later. The first group will have working AI by 2027. The second group will have a series of disappointments and a renewed budget conversation.
The architecture doesn't simplify ITSM. It changes where complexity lives.
Before, complexity sat inside individual tools. In the new architecture, complexity sits in the AI orchestration layer above them. If your foundation is strong, clean data, structured knowledge, consistent workflows, the new architecture unlocks real automation across systems. If your foundation is weak, the same architecture amplifies inconsistency at speed, across more systems than before. The shift makes the foundation more important, not less.
Distill scores your service desk data across the categories that determine whether AI orchestration delivers, categorisation consistency, resolution quality, knowledge coverage, and workflow signal. Five minutes, no signup, runs entirely in your browser.
Built for ServiceNow, Halo, Freshservice, Zendesk, and TOPdesk, or any CSV.