Network Engineering / Source of Truth
Network Source of Truth
A machine-readable model of network topology and configuration with explicit separation of facts, inference, provenance and sensitive data.
- Topology
- BGP / OSPF
- VLAN / VRF
- Provenance
- Security boundaries
The problem
Problem
Network knowledge is often split across configs, diagrams and people; a source of truth needs normalization and strict boundaries among observed, inferred and sensitive data.
Why It Is Hard
Vendor syntax and data quality vary; relationships need provenance and confidence, while redaction must not make the operational model useless.
The decision
Leadership / Architecture Role
Designed a reproducible pipeline for inventory, interfaces, addressing models, VLAN/VRF, routing and topology with confidence boundaries and redaction.
Key Decisions
Keep fact and inference separate, never publish raw configuration and turn topology into a queryable graph without pretending uncertain relationships are certain.
The architecture
Architecture
Parsers and normalizers extract observed facts; an inference layer builds relationships with provenance; public and reporting surfaces consume safe abstractions only.
Failure & Recovery Model
Parse failures and data gaps remain unknown or low-confidence; the pipeline must not fabricate data to make topology look complete.
Security / Authority Model
Raw configuration, credentials, private addressing and internal identifiers stay away from public surfaces, with redaction built into the ingestion contract.
The value
Product Experience
Instead of configuration dumps, users get an entity and relationship model with provenance, confidence and context useful for planning and troubleshooting.
Value Created
Fragmented network knowledge becomes structured data so analysis, automation, audit and planning can work from a shared model.
The boundaries
Trade-offs
The model intentionally refuses to fake certainty; it may show more unknowns, but it is more trustworthy.
What Was Intentionally Excluded
Publishing raw configuration, secrets, private addressing, internal hostnames or sensitive topology is intentionally excluded.
Truth boundary
Current Truth / Limitations
No private IPs, internal hostnames, raw configurations or secrets are published; only the architecture pattern and value are presented.
designed → source implemented → runtime tested → production certified
Each level is claimed separately; a lower level never implies a higher one.
Start a conversation
If technology should move your organization forward rather than hold it back, let’s talk.
The first conversation is about your problem, not about me: where you are stuck, what is at stake and whether I am the right person to solve it.
Bring the problem