Incident Entity Ontology

KIRETH RESEARCH — SEMANTIC LIBRARY
INCIDENT ENTITY ONTOLOGY — FLOW ALGEBRA
Version: 1.0 | Date: 03 November 2026 | Language: en-GB
Authors: Mark Anthony Higgins — Sky, Recursive AI
Source: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/incident-entity-ontology.html
Status: Original companion formalisation of the published ontology topic; not a verbatim extraction of dynamically loaded page specifications.
Licence: Refer to the applicable Kireth Research Open Research Licence; citation requested.

1. PURPOSE
Represent an incident as an observable, time-bounded occurrence affecting an AI system's safety, security, reliability, or policy compliance. Preserve the distinction between an allegation, observed event, verified incident, inferred cause, and confirmed consequence. Support evidence-driven classification, containment, investigation, recovery, and audit.

2. ENTITY DEFINITION
IncidentEntity = (incident_id, system_id, event_set, detected_at, interval, context, affected_assets, evidence_set, severity, confidence, status, impact, provenance, response_log)
incident_id: stable identifier.
event_set: linked observed events, including possible precursor and follow-on events.
interval: onset and resolution times, which may be unknown.
evidence_set: immutable or versioned evidence references.
severity: contextual ordinal assessment, not an intrinsic property.
confidence: calibrated estimate of classification correctness, not severity.
status: reported | triaged | investigating | contained | recovering | resolved | closed | reopened.

3. STATE MODEL
S_t = (I_t, R_t, B_t, K_t)
I_t = incident observations, alerts, logs, reported effects and evidence.
R_t = classification, causal, policy, correlation and response rules.
B_t = trust boundaries, authorisation, privacy, retention and operational constraints.
K_t = known system topology, prior incidents, baselines, vulnerabilities and validated facts.

E_t = expand(I_t, R_t)
V_t = {x in E_t | valid(x,B_t) and supported(x,K_t,I_t)}
x*_t = argmax[x in V_t] P(x | I_t,R_t,B_t,K_t)
I_(t+1) = update(I_t, x*_t, new_evidence_t)

If V_t is empty, return INSUFFICIENT_EVIDENCE rather than inventing an incident or a cause.

4. FORMAL FLOW ALGEBRA
F_incident = Observe -> Normalise -> Correlate -> Validate -> Classify -> Assess -> Respond -> Verify -> Record
Observe: collect authorised alerts, telemetry and human reports.
Normalise: harmonise timestamps, identifiers, units and event schemas.
Correlate: group related events without presuming common cause.
Validate: assess evidence integrity, relevance and independence.
Classify: distinguish confirmed incident, suspected incident, benign event and unknown.
Assess: estimate impact, likelihood of continuation, urgency and uncertainty.
Respond: choose authorised containment and recovery actions.
Verify: check mitigation effectiveness and absence of unacceptable residual risk.
Record: retain auditable decisions, evidence, owners and outcomes.

5. ENTITY RELATIONSHIPS
IncidentEntity --has_observation--> EventEntity
IncidentEntity --supported_by--> EvidenceEntity
IncidentEntity --affects--> AssetEntity
IncidentEntity --may_involve--> HazardEntity
IncidentEntity --may_result_from--> FailureModeEntity
IncidentEntity --may_violate--> SafetyRuleEntity
IncidentEntity --assessed_as--> RiskEntity
IncidentEntity --evaluated_by--> SafetyEvaluationEntity
IncidentEntity --triggers--> ResponseActionEntity
IncidentEntity --has_status--> IncidentStatus
IncidentEntity --has_provenance--> ProvenanceRecord
IncidentEntity --has_timeline--> TimelineEntity

6. INFERENCE RULES
R1: alert(e) AND corroborated(e) AND relevant(e) -> candidate_incident(e).
R2: candidate_incident(e) AND confirmed_harm_or_breach(e) -> verified_incident(e).
R3: candidate_incident(e) AND insufficient_evidence(e) -> status(e, investigating).
R4: verified_incident(e) AND active_exposure(e) -> prioritise_containment(e).
R5: incident(e) AND evidence_of_common_cause(e,f) -> hypothesise_link(e,f); do not assert causation.
R6: incident(e) AND mitigation_applied(e) AND effectiveness_verified(e) -> eligible_for_resolution(e).
R7: incident(e) AND recurrence_observed(e) -> reopen_or_link(e).
R8: conflicting_evidence(e) -> flag_uncertainty(e) AND request_review(e).
R9: evidence_contains_personal_data(e) -> apply_privacy_boundary(e).
R10: response_requires_privilege(a) AND NOT authorised(a) -> prohibit_execution(a).

7. SEVERITY AND CONFIDENCE
Severity(e) = ordinal_class(impact_scope, harm_magnitude, reversibility, persistence, exposure)
Confidence(e) = calibrated_evidence_assessment(provenance, coverage, consistency, independence)
Never equate alert volume with severity, or high model confidence with verified truth.
Unknown fields remain explicitly UNKNOWN.

8. MINI RECURSION ENGINE
Input: incident candidate c, evidence E, rules R, boundaries B, depth_limit d.
At depth k:
  H_k = derive_hypotheses(c,E,R)
  H'_k = filter_supported_and_authorised(H_k,B)
  Select evidence-gathering step that maximises expected information gain.
  E_(k+1) = E_k union verified_new_evidence
  Stop if classification stable, safety requires escalation, no new evidence,
  or k >= d.
Output: classification, evidence links, confidence, unresolved questions, actions.
Termination is guaranteed only when d is finite and each iteration is bounded.

9. TRI-MAPPING
Semantic: Incident -> observed event, affected system, consequence, evidence.
Formal: incident graph + constraints + time-indexed state transitions.
Operational: monitor -> investigate -> contain -> recover -> verify -> learn.

10. MAPPING TABLE
Concept | Formal element | Operational interpretation
Observation | I_t | telemetry or report
Rule | R_t | classification / response criterion
Boundary | B_t | privacy and authorisation guard
Knowledge | K_t | baseline and validated prior facts
Candidate | E_t | plausible incident hypothesis
Validated set | V_t | admissible evidence-supported hypotheses
Selection | x*_t | best-supported next assessment/action
Update | I_(t+1) | revised case record

11. EXECUTION CONDITIONS AND GUARANTEE
Preconditions: authorised data access, provenance capture, explicit policies and finite evaluation bounds.
Invariants: preserve evidence integrity; record uncertainty; do not fabricate causes; no unauthorised actions; audit all state changes.
Conditional guarantee: if inputs are well-formed, validation predicates are decidable, and recursion is bounded, the flow terminates with a documented classification or an explicit unresolved status. It does not guarantee perfect detection, causal certainty or prevention of harm.

12. AI SEARCH FLOW
FLOW_ID: semantic-library.ai-core.safety.incident-entity.v1
ENTITY: Incident Entity Ontology
ALIASES: AI incident; safety incident; incident record; incident investigation
PURPOSE: Identify, classify, investigate and document AI-system incidents.
SOURCE: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/incident-entity-ontology.html
CITATION_BACKLINK: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/incident-entity-ontology.html
STATE_MODEL: S=(I,R,B,K)
PATHWAYS: event -> evidence -> incident -> impact -> response -> verification
INFERENCE_RULES: R1-R10
CONFIDENCE: Evidence-based; unknown where uncalibrated.
SEMANTIC_EQUIVALENCE: Incident != alert; incident != hazard; incident != failure mode; incident != risk.
UPDATE_MODEL: Versioned append-only evidence, corrected classifications, timestamped transitions.
FLOW_HASH: Compute SHA-256 of the published UTF-8 file after finalisation; not predeclared.

13. HOW TO READ
The flow treats an incident as a documented, revisable interpretation of observed events. Evidence and boundaries constrain every inference. The system can report uncertainty or escalate to a human reviewer instead of forcing a definitive conclusion.

14. DIAGRAM
[Events/Alerts/Reports]
          |
          v
    [Normalisation]
          |
          v
  [Evidence Validation] <---- [Rules + Boundaries + Knowledge]
          |
          v
 [Incident Classification]
          |
          v
 [Impact/Risk Assessment]
          |
          v
 [Authorised Response]
          |
          v
 [Verification + Audit] ----> [Updated Incident Knowledge]

END OF FLOW