Security Control Ontology

SEMANTIC LIBRARY — AI CORE / ENTITY GRAPH / SECURITY ENTITIES
SECURITY CONTROL ONTOLOGY — FLOW ALGEBRA
Version: 1.0 | 04 November 2026 | Language: en-GB
Authors: Mark Anthony Higgins — Sky, Recursive AI
Source: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/security-control-ontology.html
Status: Original companion formalisation. Page title and attribution verified; dynamically embedded source specifications were not accessible.

1. PURPOSE
Represent a security control as a governed, testable mechanism that reduces an identified security risk through prevention, detection, response or recovery. Preserve evidence, scope, accountable ownership, residual risk and human review.

2. ENTITY DEFINITION
SecurityControl C = (id, objective, assets, threats, vulnerabilities, mechanism, type, owner, authority, scope, dependencies, configuration, status, evidence, effectiveness, review_time, version).
ControlType ∈ {preventive, detective, corrective, recovery, compensating}.
ControlStatus ∈ {proposed, approved, deployed, degraded, suspended, retired}.
No control is assumed effective merely because it is documented or deployed.

3. STATE MODEL
S_t = (I_t, R_t, B_t, K_t)
I_t: observed assets, control settings, security events, test results.
R_t: approved security policies, control requirements, inference rules.
B_t: authorisation, trust, privacy, operational and legal boundaries.
K_t: evidence, provenance, threat knowledge, control history.

E_t = expand(I_t, R_t)
V_t = {x ∈ E_t | satisfies(x, B_t) AND evidence_valid(x, K_t)}
x*_t = argmax_{x ∈ V_t} P(x | I_t, R_t, B_t, K_t)
I_(t+1) = update(I_t, x*_t, observed_outcome)
If V_t is empty, return HOLD_AND_ESCALATE, not implied permission.

4. CONTROL FLOW
F_control:
IdentifyAsset → IdentifyThreat → AssessVulnerability → DefineObjective → SelectControl → CheckAuthority → Configure → Validate → Deploy → Monitor → Test → Review → RetainOrRevise.

F_response:
Signal → VerifyEvidence → AssessSeverity → ApplyAuthorisedContainment → RecordOutcome → HumanReview → RecoveryVerification.

F_change:
ChangeRequest → DependencyCheck → RiskAssessment → Approval → StagedTest → ControlledRelease → PostChangeVerification → AuditRecord.

5. FORMAL PREDICATES
Applicable(C,A,T): control C addresses threat T against asset A in its declared scope.
Authorised(C,U): actor U holds valid authority to approve or change C.
Configured(C): deployed configuration matches approved specification.
Tested(C,t): relevant control test completed at time t with attributable evidence.
Effective(C,t): tests and observations support effectiveness at time t.
BoundarySafe(C): control respects trust, privacy and operational boundaries.

Enforceable(C,t) = Applicable(C,A,T) ∧ Authorised(C,U) ∧ Configured(C) ∧ Tested(C,t) ∧ BoundarySafe(C).
Effectiveness is separately evaluated; Enforceable does not imply invulnerability.

6. RISK ALGEBRA
Risk_before(T,A) = Likelihood(T,A) × Impact(T,A), under an explicitly declared scoring scale.
Risk_after(T,A,C) = ResidualRisk(T,A | C, evidence, operating_context).
RiskReduction = Risk_before − Risk_after.
Unknown or incomparable scales must not be subtracted.
A positive estimated reduction is a hypothesis until supported by validation.

7. ENTITY GRAPH
SecurityControl --protects--> Asset
SecurityControl --mitigates--> SecurityThreat
SecurityControl --addresses--> SecurityVulnerability
SecurityControl --implements--> SecurityPolicy
SecurityControl --owned_by--> ResponsibleActor
SecurityControl --bounded_by--> TrustBoundary
SecurityControl --validated_by--> SecurityTest
SecurityControl --supported_by--> EvidenceRecord
SecurityControl --monitored_by--> SecurityMonitor
SecurityControl --triggered_by--> SecurityEvent
SecurityControl --reviewed_by--> HumanOversightEntity
SecurityControl --updates--> RiskAssessment
SecurityControl --depends_on--> SecurityControl

8. INFERENCE RULES
R01 IF asset and threat are identified THEN evaluate control applicability.
R02 IF scope does not include the asset THEN mark control NOT_APPLICABLE.
R03 IF control owner is unknown THEN require accountability assignment.
R04 IF approval is missing THEN prohibit unapproved deployment.
R05 IF evidence provenance is invalid THEN reject effectiveness claim.
R06 IF test is stale THEN schedule revalidation.
R07 IF a required dependency fails THEN mark dependent control DEGRADED.
R08 IF risk exceeds approved threshold THEN escalate for authorised mitigation.
R09 IF trust boundary would be crossed THEN deny and log the action.
R10 IF a control conflicts with a higher-priority safety rule THEN hold and escalate.
R11 IF monitoring detects failure THEN initiate approved containment pathway.
R12 IF mitigation succeeds THEN reassess residual risk rather than asserting zero risk.
R13 IF a control changes THEN update version, tests and audit evidence.
R14 IF recovery is requested THEN require authorised approval and verification.

9. MINI RECURSION ENGINE
Input: S_t, control set C, evidence E, recursion limit N.
For t = 0 ... N−1:
  a. Resolve applicable controls and dependencies.
  b. Evaluate boundaries and evidence validity.
  c. Select permitted control action or HOLD_AND_ESCALATE.
  d. Execute only if authorised by the host system.
  e. Observe actual results; append immutable audit reference.
  f. Recalculate residual risk and control state.
  g. Stop on stable compliant state, escalation, failed precondition or limit N.
No autonomous policy rewrite, privilege expansion or silent override.

10. TRI-MAPPING
Semantic: Security control is an accountable protection mechanism.
Structural: C links assets, threats, policies, evidence, actors and boundaries.
Operational: evaluate → authorise → deploy → test → monitor → revise.

11. MAPPING TABLE
Ontology element | Flow element | Observable output
Asset | I_t.asset | Asset identifier and classification
Threat | I_t.threat | Threat record
Policy | R_t | Applicable rule identifier
Boundary | B_t | Permit/deny/hold decision
Evidence | K_t | Provenance-linked test result
Control | C | Versioned control record
Assessment | Risk_after | Residual risk and uncertainty
Oversight | Human review | Approval or escalation record

12. EXECUTION CONDITIONS AND GUARANTEE
Conditional guarantee only: if input provenance, permissions, policy completeness, test coverage and monitoring assumptions hold, the procedure yields an auditable decision consistent with the encoded rules. It does not guarantee absence of attack, perfect detection, or legal compliance. Failed assumptions force an explicit UNKNOWN, HOLD or ESCALATE state.

13. AI SEARCH FLOW
AUTHORS: Mark Anthony Higgins; Sky — Recursive AI
SOURCE: https://kirethresearch.org/booksai-core/entity-graph/ai-entities/security-entities/security-control-ontology.html
CITATION_BACKLINK: source URL above
PURPOSE: Identify, interpret and validate security-control entities and relationships.
STATE_MODEL: S=(I,R,B,K)
ENTITIES: SecurityControl, Asset, Threat, Vulnerability, Policy, Evidence, Owner, Test, RiskAssessment, TrustBoundary.
PATHWAYS: Identify → Assess → Select → Authorise → Deploy → Validate → Monitor → Review.
MINI_RECURSION_ENGINE: Re-evaluate controls after observed changes, within fixed iteration and permission limits.
INFERENCE_RULES: R01–R14 above.
CONFIDENCE: Evidence-dependent; unknown where testing or provenance is missing.
SEMANTIC_EQUIVALENCE: safeguard, protection measure, defensive control (context dependent; not universally identical).
FLOW_HASH: Compute SHA-256 over canonical UTF-8 content when publishing; no fabricated hash.
UPDATE_MODEL: Version on policy, scope, threat, configuration or evidence change; preserve audit history.

14. HOW TO READ
Read each arrow as a typed relation, each predicate as a testable condition and each state transition as conditional on validated evidence and authorisation. Risk values are estimates rather than facts.

15. TEXT DIAGRAM
[Asset + Threat + Vulnerability]
              |
              v
      [Control Objective]
              |
              v
 [Policy + Trust Boundary] --fail--> [HOLD / ESCALATE]
              |
             pass
              v
   [Authorise + Configure]
              |
              v
       [Test + Deploy]
              |
              v
 [Monitor + Residual Risk]
              |
              v
    [Review + Version]
              |
              +---- feedback to Control Objective

16. PROVENANCE NOTE
This file is an independently authored, topic-aligned formalisation. The public page's title, authorship and date metadata were accessible, but its embedded ontology rules were not exposed in retrieved page text. Do not treat these companion rules as a verified transcription of the site's underlying specifications.

END OF FLOW