NOW

The thesis for ServiceNow breaks structurally — not merely underperforms — under three observable conditions. First, if a foundation-model provider ships a credible incident-and-change-request layer with typed ownership fields, named state transitions, and a queryable audit API, and enterprise customers begin re-platforming ITSM workflows onto it, that would directly falsify P1 through P3 for NOW; the concrete signal to watch is a major analyst firm removing ServiceNow from the ITSM Magic Quadrant leader position in favour of a model-lab-affiliated entrant. Second, if ServiceNow's disclosed agent-SKU ARR mix stalls or reverses — meaning the Pro Plus and Now Assist attach rates plateau in two consecutive earnings reports while total subscription revenue growth decelerates below the company's own guidance band — that is the failure-to-monetise invalidator firing specifically on NOW, since the entire bull case rests on the company converting its installed workflow state into incremental consumption revenue. Third, Microsoft represents the most credible hyperscaler-bundling threat: if Copilot for ITSM is included in an E5 or equivalent enterprise agreement at no meaningful incremental cost and enterprise customers publicly cite it as a NOW replacement rather than a complement, P3 and P5 erode because ownership and queryable history shift into the Microsoft graph. Open-source clone risk (Plane, OpenProject analogues for ITSM) is a slower-moving signal for ServiceNow given its upper-enterprise seat base, but sustained gross-margin compression below 78% on subscription revenue would indicate pricing-power erosion worth escalating to a trim signal. Underperformance in the share price absent one of these structural breaks is explicitly not falsification per ADR 0016.