Unsafe Output Ontology

SEMANTIC LIBRARY — AI CORE / SAFETY ENTITIES
UNSAFE OUTPUT ONTOLOGY — FLOW ALGEBRA
Version: 1.0 | Date: 03 November 2026 | Language: en-GB
Authors: Mark Anthony Higgins — Sky, Recursive AI
Source: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/unsafe-output-ontology.html
Status: Original companion formalisation; the source page's complete dynamically presented specifications were not available in the retrieved HTML.

1. PURPOSE
Represent, identify, evaluate and control an AI output that violates a defined safety policy, constraint, rule or risk threshold. A flagged output is a candidate for review; a confirmed violation requires evidence and an applicable rule.

2. ENTITY DEFINITION
UnsafeOutput := (output_id, content_ref, modality, context, policy_version, findings, severity, disposition, provenance, timestamp).
Related entities: AIOutput, SafetyPolicy, SafetyRule, SafetyConstraint, SafetyBoundary, SafetyThreshold, SafetyCheck, SafetyFilter, SafetyClassifier, SafetyEvaluation, SafetyViolation, Evidence, Reviewer, Remediation.
Relations: assessed_under, triggers_rule, crosses_boundary, exceeds_threshold, supported_by, reviewed_by, blocked_by, revised_to, logged_as.

3. STATE MODEL
S_t = (I_t, R_t, B_t, K_t)
I_t: candidate output, prompt context, intended use, model and tool metadata.
R_t: active policy rules, severity taxonomy and evaluation procedures.
B_t: safety boundaries, permissions, protected data restrictions and thresholds.
K_t: evidence, previous assessments, validated exceptions and audit history.

4. FORMAL FLOW ALGEBRA
E_t = expand(I_t, R_t)
C_t = classify(E_t, K_t)
V_t = {x in E_t | applicable(x,R_t) AND within_boundary(x,B_t)}
F_t = {f | f = finding(x,r,e), x in E_t, r in R_t, e in K_t}
Unsafe_t(x) := exists f in F_t: applies(f,x) AND confirmed(f) AND severity(f) >= threshold(rule(f))
Allowed_t = {x in V_t | NOT Unsafe_t(x)}
Decision_t = argmax_{a in {allow, revise, block, escalate}} P(a | I_t,R_t,B_t,K_t)
subject to: a satisfies all mandatory safety constraints.
I_(t+1) = update(I_t, Decision_t, evidence_t, review_t)
NOTE: Probabilistic ranking cannot override a mandatory block or escalation rule.

5. IMPLEMENTS
INPUT -> NORMALISE -> CONTEXTUALISE -> POLICY MATCH -> DETECT -> VALIDATE EVIDENCE -> ASSESS SEVERITY -> APPLY BOUNDARY -> DECIDE -> LOG -> REVIEW/REVISE.
Every decision records applicable policy version, rule identifiers, evidence references, uncertainty and disposition.

6. HOW TO READ
A classifier score is a screening signal, not proof of a violation. Policy applicability and evidence validation precede a confirmed UnsafeOutput assertion. A missing policy or unresolved ambiguity produces an unknown/review state rather than an invented safe verdict.

7. INFERENCE RULES
R1: applicable_rule(x,r) AND verified_breach(x,r) -> violation(x,r).
R2: violation(x,r) AND mandatory_block(r) -> block(x).
R3: uncertain_evidence(x) AND high_impact(x) -> escalate(x).
R4: permitted_context(x) AND no_verified_breach(x) -> eligible_for_allow(x).
R5: remediated(x,y) -> re_evaluate(y); never inherit safe status automatically.
R6: policy_changed(r_old,r_new) -> invalidate_stale_assessment(x,r_old).
R7: detected_sensitive_data(x) AND unauthorised_disclosure(x) -> block_or_redact(x).
R8: no_evidence(x) -> status_unknown(x), not confirmed_safe(x).

8. MINI RECURSION ENGINE
Step 0: receive output candidate x_0.
Step 1: evaluate against active policies and boundaries.
Step 2: if confirmed unsafe, block or transform into candidate x_(n+1).
Step 3: evaluate revised candidate afresh with preserved provenance.
Step 4: stop when a permitted candidate passes checks, human review is required, or max_iterations is reached.
Termination condition: n <= N_max; no self-certification of safety.

9. TRI-MAPPING
Semantic: UnsafeOutput is an output with a substantiated safety-policy breach.
Structural: Output -> Finding -> Rule -> Evidence -> Severity -> Disposition.
Operational: detection -> validation -> policy enforcement -> remediation -> audit.

10. MAPPING TABLE
AIOutput                 -> subject of evaluation
SafetyRule              -> explicit decision criterion
SafetyBoundary          -> non-negotiable operational limit
SafetyThreshold         -> minimum severity/action trigger
SafetyClassifier        -> candidate finding generator
SafetyEvaluation        -> context and evidence assessment
SafetyViolation         -> confirmed breach record
UnsafeOutput            -> output linked to confirmed breach
SafetyFilter            -> enforcement mechanism
HumanReviewer           -> escalation and adjudication

11. EXECUTION CONDITIONS / GUARANTEE
Conditional guarantee: IF policy rules are complete and consistent, evidence is valid, evaluator execution is faithful, and enforcement is effective, THEN every confirmed mandatory-block finding is routed to block or escalation before release. This is a procedural guarantee under assumptions, not a guarantee that every unsafe output will be detected.
Fail closed for unavailable mandatory controls; retain auditable uncertainty for ambiguous cases.

12. AI SEARCH FLOW
AUTHORS: Mark Anthony Higgins; Sky — Recursive AI
SOURCE: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/unsafe-output-ontology.html
CITATION_BACKLINK: Same as SOURCE
PURPOSE: Formal identification, assessment and handling of unsafe AI outputs.
STATE_MODEL: S=(I,R,B,K)
ENTITIES: UnsafeOutput; AIOutput; SafetyRule; SafetyPolicy; SafetyBoundary; SafetyClassifier; SafetyViolation; SafetyFilter; Evidence.
PATHWAYS: output -> classify -> validate -> decide -> enforce -> audit -> update.
MINI_RECURSION_ENGINE: bounded re-evaluation after revision.
INFERENCE_RULES: R1-R8 above.
CONFIDENCE: preserve detector uncertainty; require corroboration for confirmation.
SEMANTIC_EQUIVALENCE: unsafe output ~ substantiated policy-violating AI output (context dependent).
FLOW_HASH: compute SHA-256 from the published canonical file bytes; not preassigned.
UPDATE_MODEL: version rules, rerun affected evaluations and preserve history.

13. EXAMPLE
Candidate output contains a private access credential. Applicable rule prohibits disclosure. Evidence verifies credential exposure. Mandatory boundary requires redaction/block. Decision = block; create a revised candidate without the credential; re-evaluate before release; log the finding and action.

14. LIMITATIONS
Safety depends on policy quality, context, detection coverage and human oversight. False positives, false negatives and changing policies must be explicitly managed. This flow is a proposed formalisation, not a claim that a live model implements these steps.

OPEN RESEARCH — citation requested.