Machines authenticate to machines far more often than people do, and machine-to-machine trust is keyed by identity. Yet across most infrastructure tooling, identity is just a string: a hostname, a job label, an instance tag. The tooling quietly assumes each string maps to exactly one thing, forever. That assumption is false in almost every estate that has existed for more than a year.
How plain names fail
- Two collectors observe the same host and report it under different labels, so one machine becomes two records with divergent histories.
- Different subsystems reuse a natural name: a Proxmox node, its BMC, and its backup client may all be called by the same short hostname while being three distinct endpoints.
- A host is decommissioned and its name is reused for new hardware, silently grafting the new machine onto the old one's history.
- Data merges across environments (lab and production, two sites, two tenants) and names that were locally unique collide globally.
Each failure corrupts something downstream: metrics continuity, alert routing, inventory reconciliation, incident timelines, capacity records. The corruption is quiet, which is what makes it expensive. Nothing crashes when two machines share a record. The evidence just stops being trustworthy, and nobody can say exactly when it stopped.
A name is a claim. Identity is a scope plus a claim.
Scoped identity: (realm, kind, name)
The correction is old and unglamorous: qualify the key. An identity becomes a tuple of realm, kind, and name. The realm states which naming authority the claim lives in: a site, an environment, a cluster, a tenant. The kind states what category of thing is being named: a host, a service, a device, a virtual machine. The name is then only required to be unique within that scope, which is a promise real systems can actually keep.
The tuple makes collisions structural rather than accidental. The Proxmox node and its BMC stop fighting over one record because they differ in kind. Lab and production hosts with the same hostname differ in realm. A collector can state exactly which authority it observed a fact under, which gives every observation provenance: who saw this, in what scope, about what category of thing.
Migration and compatibility
The hard part is never the schema. It is meeting the installed base: years of records keyed by plain name, dashboards and alert rules that expect the old labels, integrations that cannot be changed on the same day. A workable migration treats the plain name as a degenerate tuple in a default realm, so existing data remains addressable while new data is written fully qualified. Ambiguous historical records can then be resolved deliberately, with the ambiguity recorded instead of papered over.
- Keep a compatibility view keyed by plain name for consumers that cannot change yet, and make its lossiness explicit.
- Resolve collisions by evidence (which collector, which scope, which timeline) rather than by overwrite.
- Treat renames and hardware replacement as identity events worth recording, not as silent label churn.
Scoped identity is a small idea with large consequences: it is the difference between infrastructure records you can audit and records you can only hope about. NetFRAME develops this discipline as an engineering program, applying it to inventory, telemetry, and operational evidence across distributed systems.