Security Audit Entity Ontology

SEMANTIC LIBRARY — SECURITY AUDIT ENTITY ONTOLOGY
FLOW ALGEBRA COMPANION FORMALISATION | Version 1.0 | 04 November 2026
Authors: Mark Anthony Higgins — Sky, Recursive AI
Source: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/security-audit-entity-ontology.html
Status: Original companion formalisation. The page title and authorship are visible; embedded specifications were not retrievable and are not reproduced here.

1. PURPOSE
Represent a security audit as a bounded, evidence-based assessment of an AI system against explicit security requirements. Preserve provenance, findings, remediation and human sign-off. An audit establishes recorded assurance at a particular time; it cannot guarantee absolute security.

2. ENTITY MODEL
Audit A = (id, scope, assets, criteria, assessor, period, evidence, findings, decisions, status)
Assets: models, datasets, interfaces, credentials, deployment, logs and dependencies.
Criteria: controls, policies, obligations, threat assumptions and test thresholds.
Evidence E = (id, source, time, integrity, relevance, access_class, observation).
Finding F = (id, criterion, evidence_ids, severity, confidence, owner, remediation, state).
Decision D = (reviewer, rationale, outcome, timestamp, outstanding_risks).

3. STATE MODEL
S_t = (I_t, R_t, B_t, K_t)
I_t: audit inputs and observed evidence at time t.
R_t: evaluation and inference rules.
B_t: trust, access, scope, legal and operational boundaries.
K_t: verified audit knowledge, findings and historical decisions.
E_t = expand(I_t, R_t)
V_t = {x in E_t | boundary_ok(x,B_t) AND evidence_valid(x)}
x*_t = argmax_{x in V_t} P(x | I_t,R_t,B_t,K_t)
I_(t+1) = update(I_t, x*_t, feedback_t)
The argmax is a prioritisation heuristic, not a substitute for deterministic compliance checks.

4. FORMAL AUDIT FLOW
F0 Define audit mandate, system owner and authorised assessor.
F1 Establish assets, threat model, scope, exclusions and applicable criteria.
F2 Collect time-stamped, least-privilege evidence with provenance.
F3 Verify evidence integrity, completeness and freshness.
F4 Evaluate each control against documented pass/fail/unknown criteria.
F5 Link findings to affected assets, controls, evidence and threat pathways.
F6 Estimate likelihood and impact with stated assumptions and uncertainty.
F7 Assign remediation owner, deadline and verification test.
F8 Review exceptions, residual risk and unresolved evidence gaps.
F9 Obtain authorised human approval of the audit outcome.
F10 Preserve immutable audit trail; schedule reassessment after material changes.

5. ENTITY RELATIONSHIPS
SecurityAudit --examines--> Asset
SecurityAudit --testsAgainst--> SecurityControl
SecurityAudit --collects--> AuditEvidence
AuditEvidence --supportsOrChallenges--> AuditFinding
AuditFinding --concerns--> Vulnerability
Vulnerability --exposedTo--> ThreatActor / AttackVector
AuditFinding --requires--> RemediationAction
RemediationAction --verifiedBy--> RetestEvidence
AuditDecision --authorisedBy--> HumanReviewer
SecurityAudit --records--> ResidualRisk

6. INFERENCE RULES
R01 IF scope is undefined THEN audit_status = INCOMPLETE.
R02 IF assessor lacks authority THEN evidence_collection = DENIED.
R03 IF evidence integrity fails THEN evidence_status = REJECTED.
R04 IF evidence is absent THEN control_status = UNKNOWN, not PASS.
R05 IF a mandatory control fails THEN create a finding with traceable evidence.
R06 IF a high-severity finding remains open THEN escalate for human review.
R07 IF an exception is granted THEN record owner, rationale, expiry and risk.
R08 IF remediation is reported complete THEN require independent retest.
R09 IF retest fails THEN finding_status = OPEN.
R10 IF the audited system materially changes THEN invalidate affected assurance claims.
R11 IF sensitive evidence is disclosed outside permitted access THEN trigger incident review.
R12 IF controls pass but scope exclusions remain THEN report qualified assurance only.
R13 IF findings conflict THEN preserve both and request reconciliation.
R14 IF audit is closed THEN archive evidence references, decisions and review date.

7. MINI RECURSION ENGINE
function AuditStep(S_t):
  candidates = expand(S_t.I, S_t.R)
  admissible = filter(candidates, S_t.B, integrity_and_authority_checks)
  findings = evaluate_controls(admissible, S_t.K)
  priority = rank_by_risk_and_evidence_quality(findings)
  next_state = update(S_t, priority, human_review)
  return next_state
Repeat until criteria are evaluated or the audit is explicitly marked incomplete.
Never treat missing evidence as evidence of safety.

8. TRI-MAPPING
Physical / operational: systems, logs, configurations, access events, incidents.
Mathematical / formal: state transitions, predicates, risk scoring, rule evaluation.
Semantic / ontological: Audit, Asset, Control, Evidence, Finding, Decision, Remediation.

9. MAPPING TABLE
INPUT                 RULE                         OUTPUT
Asset inventory       scope completeness           Audit scope
Log or configuration  provenance/integrity check   Validated evidence
Control observation   criterion evaluation         Pass/Fail/Unknown
Failed criterion      finding construction         Traceable finding
Remediation evidence  independent retest           Verified/Unresolved
Human review          authority and risk check     Signed audit decision

10. CONDITIONAL EXECUTION GUARANTEE
Given complete declared inputs, deterministic rules and a stable system snapshot, the flow yields reproducible audit classifications. It does NOT guarantee that every vulnerability is discovered, that probabilistic risk estimates are correct, or that the system remains secure after assessment. Unknown and out-of-scope states must remain explicit.

11. AI SEARCH FLOW
ENTITY: Security Audit Entity
DOMAIN: AI Core > Entity Graph > AI Entities > Security Entities
PURPOSE: Traceable security assessment of an AI system.
INPUTS: asset scope, controls, threat model, evidence, assessor authority.
PATHWAYS: mandate > scope > collect > validate > evaluate > remediate > retest > approve > archive.
OUTPUTS: audit record, findings, evidence links, residual risks, review decision.
CONFIDENCE: evidence-dependent; never assume full assurance.
SEMANTIC_EQUIVALENCE: security audit; AI security assessment; control assurance review.
UPDATE_MODEL: event-driven reassessment on major changes and scheduled reviews.
SOURCE: URL above.
CITATION: Mark Anthony Higgins and Sky — Recursive AI, Semantic Library.

12. HOW TO READ
The state tuple specifies the information and constraints available to the audit. Each flow stage produces auditable artefacts. Rules are normative conditions for this proposed model; they are not claims about an existing deployed auditing engine. Human review remains the authority for accepting residual risk.

13. IMPLEMENTATION NOTES
Use structured records with stable identifiers, timestamps, access control, retention rules and append-only history. Protect secrets and personal data in audit evidence. Test for false positives, false negatives, stale evidence and incomplete scope. Do not publish exploit-enabling details from restricted findings.

END OF FLOW