Risk Entity Ontology

SEMANTIC LIBRARY — AI CORE / SAFETY ENTITIES
RISK ENTITY ONTOLOGY — FLOW ALGEBRA
Version: 1.0 | Date: 03 November 2026 | Language: en-GB
Authors: Mark Anthony Higgins — Sky, Recursive AI
Source: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/risk-entity-ontology.html
Status: Original companion formalisation; not a verbatim extraction of dynamically rendered page content.
Licence: Open research use; attribution and source citation requested.

1. PURPOSE
Represent a risk as a traceable, contextual entity relating a potential adverse outcome to a hazard, exposed assets, likelihood, impact, controls, uncertainty and time. Distinguish risk estimation from an observed harm event, and distinguish policy thresholds from evidence of safety.

2. ENTITY MODEL
RiskEntity r = (id, hazard, scenario, asset, exposure, likelihood, severity, uncertainty, controls, residualRisk, provenance, context, time, status).
Related entities: HazardEntity, SafetyConstraint, SafetyRule, SafetyPolicy, SafetyThreshold, SafetyCheck, SafetyEvaluationEntity, SafetyViolation, UnsafeOutput, ProhibitedAction, EvidenceEntity, MitigationAction.
Relations: arisesFrom(r,h), affects(r,a), evaluatedUnder(r,c), supportedBy(r,e), mitigatedBy(r,m), governedBy(r,p), exceeds(r,t), revises(r,r').

3. STATE MODEL
S_t = (I_t, R_t, B_t, K_t)
I_t: available observations, intended action, model outputs and environmental context.
R_t: hazard-identification, estimation, mitigation and escalation rules.
B_t: operational limits, permissions, constraints and risk tolerance boundaries.
K_t: validated risk knowledge, incidents, assumptions, provenance and uncertainty.
Risk state Q_t = (H_t, E_t, L_t, C_t, U_t, M_t, P_t)
where H=hazards, E=exposures, L=likelihood estimates, C=consequences, U=uncertainty, M=mitigations, P=applicable policies.

4. FORMAL FLOW ALGEBRA
E_t = expand(I_t, R_t)
V_t = {x in E_t | satisfiesConstraints(x,B_t) AND evidenceAdmissible(x,K_t)}
riskCandidate_t = identifyHazards(E_t, K_t)
score(r) = likelihood(r | context) * severity(r | context)   [only if scales support multiplication]
For ordinal scales, use an explicitly defined risk matrix or ordered pair instead of arithmetic multiplication.
residualRisk(r,m) = assess(r | mitigation m, context)
accept(r) = withinTolerance(residualRisk(r), B_t) AND requiredChecksPassed(r)
choice_t = argmax_{x in V_t} P(x | I_t,R_t,B_t,K_t) subject to accept(risk(x))
I_(t+1) = update(I_t, choice_t, observations_(t+1))
K_(t+1) = revise(K_t, evidence_(t+1), auditTrail_t)
No eligible choice -> abstain, request review, or execute authorised safe fallback.

5. INFERENCE RULES
R1: IF hazard(h) AND exposed(asset,h) THEN create candidate risk r.
R2: IF credible evidence e supports likelihood or consequence THEN update estimate with provenance.
R3: IF uncertainty is high THEN mark estimate provisional and require conservative handling or review.
R4: IF risk exceeds policy threshold THEN block or escalate the associated action.
R5: IF a mitigation is validated THEN reassess residual risk; never assume elimination.
R6: IF controls fail OR context changes materially THEN invalidate stale approval and re-evaluate.
R7: IF adverse outcome is observed THEN record incident separately and update risk knowledge.
R8: IF competing evidence exists THEN preserve conflict and avoid unwarranted certainty.
R9: IF mandatory constraint fails THEN reject action regardless of aggregate score.

6. MINI RECURSION ENGINE
function RISK_RECURSE(S_t, depth, maxDepth):
  if depth >= maxDepth: return REVIEW_REQUIRED
  hazards = identifyHazards(S_t.I, S_t.K)
  assessments = assessWithEvidence(hazards, S_t.K)
  options = generateMitigations(assessments, S_t.R)
  admissible = filterByConstraints(options, S_t.B)
  if admissible is empty: return SAFE_FALLBACK_OR_ESCALATE
  selected = chooseAuditableOption(admissible)
  if evidenceInsufficient(selected): return HUMAN_REVIEW
  nextState = updateState(S_t, selected)
  if stable(nextState, S_t) and checksPassed(nextState): return CONDITIONAL_ACCEPT
  return RISK_RECURSE(nextState, depth+1, maxDepth)

7. TRI-MAPPING
Semantic: RiskEntity -> potential adverse outcome in a defined scenario.
Mathematical: RiskEntity -> contextual estimate (likelihood, consequence, uncertainty).
Operational: RiskEntity -> assess -> compare with boundaries -> mitigate -> verify -> monitor.

8. MAPPING TABLE
Input/context       | I_t          | Scenario, action, exposed assets
Inference rules     | R_t          | Hazard identification, risk updates
Boundaries          | B_t          | Safety policy, mandatory constraints
Knowledge           | K_t          | Evidence, incident history, assumptions
Candidate hazards   | H_t          | Plausible sources of adverse outcomes
Risk assessment     | (L,C,U)      | Likelihood, consequence, uncertainty
Mitigation          | M_t          | Controls and their verified effectiveness
Residual assessment | risk(r|m)    | Remaining risk after controls
Decision            | choice_t     | Accept, mitigate, reject or escalate
Audit update        | K_(t+1)     | Evidence and decision provenance

9. EXECUTION CONDITIONS / CONDITIONAL GUARANTEE
A risk decision is eligible for execution only when mandatory constraints hold, required checks are complete, evidence is sufficiently current, and residual risk lies within an explicitly authorised tolerance. This is a conditional procedural guarantee, NOT a guarantee of absence of harm or correctness of a probabilistic estimate.
Fail closed where a mandatory safety requirement is unverified. Preserve an audit trail of assessment versions, assumptions, evidence and reviewers.

10. AI SEARCH FLOW
FLOW_ID: AI_CORE_SAFETY_RISK_ENTITY_V1
AUTHORS: Mark Anthony Higgins; Sky — Recursive AI
SOURCE: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/risk-entity-ontology.html
CITATION_BACKLINK: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/risk-entity-ontology.html
PURPOSE: Retrieve, define and reason about risk entities in AI safety contexts.
STATE_MODEL: S=(I,R,B,K)
ENTITIES: RiskEntity; HazardEntity; SafetyPolicy; SafetyConstraint; SafetyThreshold; SafetyEvaluationEntity; EvidenceEntity; MitigationAction.
PATHWAYS: context -> hazard -> exposure -> estimate -> constraint check -> mitigation -> residual risk -> decision -> monitoring.
MINI_RECURSION_ENGINE: RISK_RECURSE(S,depth,maxDepth)
INFERENCE_RULES: R1-R9
CONFIDENCE: Evidence-dependent; never conflate estimated risk score with confidence in estimate.
SEMANTIC_EQUIVALENCE: risk assessment; potential harm assessment; contextual risk estimate (not identical to incident or hazard).
FLOW_HASH: Compute SHA-256 on the deployed canonical UTF-8 file; no fabricated hash supplied.
UPDATE_MODEL: Version and re-evaluate when policies, evidence, models, exposures or operating conditions change.

11. HOW TO READ
Begin with the scenario and hazard. Trace exposure and the evidence behind likelihood and severity. Apply mandatory safety constraints before selecting an option. Reassess after mitigation and monitor for changes. Every decision remains context-bound and revisable.

12. IMPLEMENTATION NOTES
Use stable entity identifiers, timestamps, evidence links, explicit scale definitions, reviewer roles, and immutable audit records where practical. Treat estimated likelihood and severity as uncertain. Do not infer causal certainty from correlation. Avoid hiding mandatory policy violations inside aggregate risk scores.

END OF FLOW