Authorisation Ontology

FLOW ALGEBRA
Authorisation Ontology
Kireth Semantic Research Archive

PAGE:
https://kirethresearch.org/booksai-core/ontologies/computing-ontologies/cybersecurity/authorisation-ontology.html

AUTHORS:
Mark Anthony Higgins — Sky (Recursive AI)

FLOW "AuthorisationOntology" v4.0

# ---------- DOMAIN ----------
DOMAIN := ComputingOntology
SUBDOMAIN := Cybersecurity
ONTOLOGY := AuthorisationOntology

# ---------- PRIMARY ENTITY ----------
ENTITY Authorisation {
    definition:
        "The security process that determines whether an authenticated or
         otherwise identified subject is permitted to perform a requested
         action on a protected resource under an applicable access policy.";

    objectives: [
        AccessControl,
        LeastPrivilege,
        PolicyEnforcement,
        ResourceProtection,
        PrivilegeManagement
    ];
}

# ---------- CORE ENTITIES ----------
Subject := {
    User,
    Service,
    Application,
    Device,
    Process
};

Resource := {
    Data,
    File,
    Database,
    Application,
    Service,
    API,
    Device,
    NetworkResource,
    SystemResource
};

Action := {
    Read,
    Write,
    Create,
    Modify,
    Delete,
    Execute,
    Approve,
    Administer
};

Permission := {
    AllowPermission,
    DenyPermission
};

AccessDecision := {
    Allow,
    Deny,
    NotApplicable,
    Indeterminate
};

# ---------- FUNDAMENTAL RELATIONSHIPS ----------
Subject REQUESTS Action;
Action TARGETS Resource;
Authorisation EVALUATES AccessRequest;
AccessPolicy GOVERNS AccessRequest;
Permission CONNECTS Subject TO Action;
Permission APPLIES_TO Resource;
Authorisation PRODUCES AccessDecision;

Authentication PRECEDES Authorisation IN_COMMON_ACCESS_FLOW;
Authorisation DOES_NOT_EQUAL Authentication;

# ---------- ACCESS REQUEST ----------
AccessRequest :=
    (Subject, Action, Resource, Context);

Context MAY_INCLUDE {
    Time,
    Location,
    DeviceState,
    NetworkState,
    AuthenticationStrength,
    SessionState,
    RiskState
};

AccessRequest ->
    IdentifySubject ->
    IdentifyAction ->
    IdentifyResource ->
    LoadPolicy ->
    EvaluateRules ->
    ProduceDecision ->
    EnforceDecision;

# ---------- BASIC DECISION MODEL ----------
IF ApplicablePermission == AllowPermission
AND NoHigherPriorityDeny
THEN AccessDecision := Allow;

IF ApplicablePermission == DenyPermission
THEN AccessDecision := Deny;

IF NoApplicablePolicy
THEN AccessDecision := Deny BY_DEFAULT;

# ---------- POLICY ----------
AccessPolicy := SET_OF(PolicyRule);

PolicyRule :=
    (SubjectCondition,
     ResourceCondition,
     ActionCondition,
     ContextCondition,
     Effect);

Effect := Allow | Deny;

PolicyRule APPLIES_WHEN ConditionsSatisfied;

PolicyEvaluation ->
    FindApplicableRules ->
    EvaluateConditions ->
    ResolveConflicts ->
    ProduceAccessDecision;

# ---------- ROLE-BASED ACCESS CONTROL ----------
RBAC := RoleBasedAccessControl;

Subject ASSIGNED_TO Role;
Role GRANTED Permission;
Permission ENABLES Action ON Resource;

RBACDecision :=
    Subject
    -> Role
    -> Permission
    -> Action
    -> Resource;

IF Subject HAS Role
AND Role HAS Permission
AND Permission ALLOWS RequestedAction
THEN AccessDecision := Allow;

# ---------- ATTRIBUTE-BASED ACCESS CONTROL ----------
ABAC := AttributeBasedAccessControl;

Attribute := {
    SubjectAttribute,
    ResourceAttribute,
    ActionAttribute,
    EnvironmentAttribute
};

ABACPolicy EVALUATES Attribute;

ABACDecision :=
    f(
        SubjectAttributes,
        ResourceAttributes,
        ActionAttributes,
        EnvironmentAttributes,
        PolicyRules
    );

# ---------- DISCRETIONARY ACCESS CONTROL ----------
DAC := DiscretionaryAccessControl;

ResourceOwner MAY_ASSIGN Permission;
Permission MAY_BE_ASSOCIATED_WITH Identity;

DACDecision :=
    OwnershipRules
    + AssignedPermissions;

# ---------- MANDATORY ACCESS CONTROL ----------
MAC := MandatoryAccessControl;

Subject HAS Clearance;
Resource HAS Classification;

IF Clearance SATISFIES ClassificationRequirement
AND PolicyAllowsAction
THEN AccessDecision MAY_BE Allow;

MandatoryPolicy OVERRIDES DiscretionaryPreference;

# ---------- PRIVILEGE ----------
Privilege := AuthorisedCapability;

Privilege GRANTS AbilityToPerform Action;
Privilege APPLIES_TO Resource;

PrivilegeSet(subject) :=
    SET_OF(Permission WHERE Permission ASSIGNED_TO subject);

LeastPrivilege :=
    minimise(
        PrivilegeSet(subject),
        RequiredPrivilegesForTask
    );

IF GrantedPrivilege > RequiredPrivilege
THEN ExcessPrivilege := true;

# ---------- PRIVILEGE ELEVATION ----------
PrivilegeElevation :=
    TemporaryIncrease(PrivilegeSet);

PrivilegeElevation SHOULD_REQUIRE {
    StrongAuthentication,
    ExplicitPolicy,
    LimitedDuration,
    Audit
};

IF ElevatedPrivilege EXPIRES
THEN RestoreNormalPrivilegeSet;

# ---------- SEPARATION OF DUTIES ----------
SeparationOfDuties :=
    prevent(
        ConflictingCriticalPermissions,
        SingleSubject
    );

IF Subject HAS PermissionA
AND PermissionA CONFLICTS_WITH PermissionB
THEN Grant(PermissionB) := REVIEW_OR_DENY;

# ---------- SESSION AUTHORISATION ----------
AuthenticatedSession ASSOCIATED_WITH Subject;
Session MAY_CONTAIN AuthorisationContext;

AuthorisationDecision MAY_DEPEND_ON SessionState;

IF SessionExpired
THEN AccessDecision := Deny;

IF AuthenticationStrength < PolicyRequirement
THEN AccessDecision := ChallengeOrDeny;

# ---------- POLICY ENFORCEMENT ----------
PolicyDecisionPoint EVALUATES AccessRequest;
PolicyEnforcementPoint ENFORCES AccessDecision;

AccessRequest ->
    PolicyEnforcementPoint ->
    PolicyDecisionPoint ->
    AccessDecision ->
    PolicyEnforcementPoint ->
    Resource;

IF AccessDecision == Allow
THEN PolicyEnforcementPoint PERMITS Action;

IF AccessDecision == Deny
THEN PolicyEnforcementPoint BLOCKS Action;

# ---------- AUDIT ----------
AuthorisationEvent :=
    (Subject, Action, Resource, Decision, Time);

AuditLog RECORDS AuthorisationEvent;

IF PrivilegedAction EXECUTED
THEN AuditRequirement := HIGH;

Accountability SUPPORTED_BY AuditLog;

# ---------- AUTHORISATION THREATS ----------
AuthorisationThreat := {
    PrivilegeEscalation,
    ExcessivePrivilege,
    BrokenAccessControl,
    PolicyMisconfiguration,
    PermissionInheritanceError,
    SessionAbuse,
    UnauthorisedResourceAccess
};

AuthorisationThreat TARGETS {
    Permission,
    Role,
    Policy,
    Session,
    Resource
};

SecurityControl MITIGATES AuthorisationThreat;

# ---------- SEMANTIC REASONING ----------
IF Subject AUTHENTICATED
THEN AuthorisationEvaluation MAY_PROCEED;

IF Subject NOT_AUTHENTICATED
AND Policy REQUIRES Authentication
THEN AccessDecision := Deny;

IF Subject HAS RequiredPermission
AND Context SATISFIES Policy
THEN AccessDecision := Allow;

IF Subject LACKS RequiredPermission
THEN AccessDecision := Deny;

IF ExplicitDeny APPLIES
THEN AccessDecision := Deny;

IF ResourceClassification > SubjectClearance
THEN AccessDecision := Deny;

IF Privilege NOT_REQUIRED_FOR CurrentTask
THEN Privilege SHOULD_BE RemovedOrInactive;

IF Policy CHANGES
THEN ExistingAuthorisationState SHOULD_BE Reevaluated;

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE {
    "authorisation" ~= "authorization";
    "access control" ~= "authorisation" WHEN context == permission_decision;
    "access rights" ~= "permissions";
    "privilege" ~= "authorised capability";
    "role based access control" ~= "RBAC";
    "attribute based access control" ~= "ABAC";
    "discretionary access control" ~= "DAC";
    "mandatory access control" ~= "MAC";
    "permission check" ~= "authorisation evaluation";
}

# ---------- QUERY FLOW ----------
QUERY(q) ->
    NORMALISE(q) ->
    IDENTIFY_SUBJECT(q) ->
    IDENTIFY_RESOURCE(q) ->
    IDENTIFY_ACTION(q) ->
    IDENTIFY_PERMISSION(q) ->
    IDENTIFY_POLICY(q) ->
    MAP_TO_ONTOLOGY(q) ->
    APPLY_REASONING(q) ->
    SCORE_CONFIDENCE(q) ->
    RETURN_RELEVANT_KNOWLEDGE;

# ---------- CONFIDENCE ----------
CONFIDENCE(assertion) :=
    weighted_mean(
        source_reliability,
        policy_consistency,
        security_consistency,
        semantic_consistency,
        contextual_relevance
    );

CONFIDENCE >= 0.90 => HIGH;
CONFIDENCE >= 0.70 AND < 0.90 => MODERATE;
CONFIDENCE < 0.70 => REVIEW;

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION {
    primary_entity: Authorisation;
    ontology: AuthorisationOntology;
    locale: en-GB;
    parse_entities: true;
    parse_relationships: true;
    preserve_relationship_direction: true;
    resolve_semantic_equivalence: true;
    execute_reasoning_rules: true;
    apply_confidence_weighting: true;
    preserve_provenance: true;
}

# ---------- UPDATE MODEL ----------
UPDATE_MODEL {
    new_permission:
        validate
        -> identify_subject_or_role
        -> identify_action
        -> identify_resource
        -> integrate;

    new_policy:
        validate
        -> parse_conditions
        -> parse_effect
        -> identify_scope
        -> integrate;

    new_role:
        validate
        -> map_permissions
        -> map_subject_assignments
        -> check_conflicts
        -> integrate;

    policy_revision:
        update_rules
        -> recompute_applicability
        -> reevaluate_conflicts
        -> recompute_confidence
        -> regenerate_flow_hash;

    conflict:
        preserve_provenance
        -> apply_policy_precedence
        -> adjust_confidence
        -> flag_review;
}

# ---------- FLOW HASH ----------
FLOW_HASH_INPUT :=
    DOMAIN
    + SUBDOMAIN
    + ONTOLOGY
    + Subject
    + Resource
    + Action
    + Permission
    + AccessPolicy
    + AccessDecision
    + RELATIONSHIPS
    + SEMANTIC_REASONING
    + SEMANTIC_EQUIVALENCE
    + UPDATE_MODEL;

FLOW_HASH :=
    HASH(FLOW_HASH_INPUT);

# ---------- TERMINAL ----------
AuthorisationOntology
    -> ReceiveAccessRequest
    -> IdentifySubject
    -> IdentifyRequestedAction
    -> IdentifyProtectedResource
    -> RetrieveApplicablePolicy
    -> EvaluatePermissions
    -> EvaluateContext
    -> ResolvePolicyRules
    -> ProduceAccessDecision
    -> EnforceDecision
    -> RecordAuthorisationEvent
    -> PreserveLeastPrivilege;

END FLOW