A Disposition Is a Decision, Not a Field

TIME — Tolerate, Invest, Migrate, Eliminate — is the most used lens in application rationalization, and one of the most abused. A column filled in on a spreadsheet looks like a decision. Often it is a guess somebody typed once and nobody owns.

A decision has four parts

• The call. The TIME disposition, plus a 6R route (rehost, replatform, repurchase, refactor, retire, retain) when the application is moving.
• The evidence. What the call rests on, specifically enough that someone else could disagree with it.
• The ratification. Who made the call, when, and in what capacity.
• The review date. A real date. A decision without one quietly becomes permanent.

Without the last three, it is a field.

Two halves of the evidence

Structural facts tell you what an application is: owner, criticality, relationships, capability mapping, contract, lifecycle. Behavioral facts tell you how it is living: incident load, change velocity, usage. A defensible disposition needs both.

• Heavy change velocity contradicts Tolerate. Someone is investing in it, whether or not the portfolio says so.
• Heavy incident load with no owner is a governance gap before it is a disposition.
• No load at all on an operational application may mean it is dormant. Or it may mean something else entirely.

Zero incidents doesn't mean dormant

Before reading "no incidents" as "nobody uses it", check whether an incident can land on the application at all. In many service desks, tickets attach to a service-catalog taxonomy that never connects to the application portfolio. The application can be busy and still show zero, because the bridge between the two is missing.

So my tooling now says it plainly on the record: a zero is a linkage gap, not dormancy, and not an Eliminate signal. The missing bridge is its own finding, and fixing it is worth more than any single disposition it would inform.

Label proposals as proposals

AI is good at drafting dispositions from evidence. It should not be the one that finalizes them. Every disposition in my portfolio carries its source — ratified by architecture, proposed by an AI, or unknown — and views show the three separately, with a ratified-only filter. They are never summed together, because a count that mixes decisions with suggestions is a count of nothing in particular.

A disposition nobody ratified is a suggestion with good formatting.

Grandfathered is not undisposed

Tools that predate the process are the easiest to skip and the likeliest to linger. They enter the portfolio with a disposition at registration: Tolerate until the next renewal by default, or Migrate with the target named when a standard already covers the need.

Write it where the platform reads it

If your portfolio lives in ServiceNow, the disposition belongs in the Planned disposition field, whose values are Invest, Sustain, Migrate and Retire. Tolerate maps to Sustain and Eliminate maps to Retire. Map the vocabulary when you write, and read the value back: a write to a similarly named field that did not exist returned success and saved nothing.

Copy this: a disposition record

disposition:
  time: Migrate              # Tolerate | Invest | Migrate | Eliminate
  six_r: Repurchase          # when the application is moving
  target: <replacement application>
  evidence:
    structural: [owner set, tier 2, 3 business capabilities, contract ends 2027-06]
    behavioral: [incidents link to the app: yes, 14 in 90 days, 2 changes in 12 months]
  source: ea-ratified        # ea-ratified | ai-proposed | unknown
  ratified_by: <role, not a person>
  ratified_on: 2026-09-24
  review_by: 2027-03-31