Access Control Ontology

FLOW ALGEBRA
Access Control Ontology
Kireth Semantic Research Archive

PAGE:
https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/administrative-metadata/access-control-ontology.html

AUTHORS:
Mark Anthony Higgins — Sky (Recursive AI)

FLOW "AccessControlOntology" v4.0

DOMAIN := MetadataOntologies
SUBDOMAIN := AdministrativeMetadata
ONTOLOGY := AccessControlOntology

ENTITY AccessControl {
    definition:
        "Administrative metadata and policy structures that determine whether
         an authenticated or otherwise identified subject may perform a
         specified action on a resource under defined roles, permissions,
         restrictions, conditions, security classifications and contextual
         rules.";
    objectives: [
        Authorisation,
        ResourceProtection,
        PermissionManagement,
        PolicyEnforcement,
        LeastPrivilege,
        Auditability,
        MachineInterpretability
    ];
}

AccessEntity := {
    AccessControl,
    Subject,
    Resource,
    Action,
    Permission,
    Denial,
    AccessDecision,
    AccessRequest
};

IdentityEntity := {
    User,
    Agent,
    Role,
    Group,
    ServiceAccount,
    Identity,
    Credential,
    AuthenticationContext
};

PolicyEntity := {
    AccessPolicy,
    PolicyRule,
    Condition,
    Restriction,
    SecurityClassification,
    Clearance,
    Scope,
    Priority
};

AuditEntity := {
    AuditRecord,
    DecisionReason,
    Timestamp,
    Provenance,
    Version,
    Confidence
};

AccessPolicy GOVERNS AccessTo Resource;
Subject REQUESTS Action ON Resource;
PolicyRule EVALUATES AccessRequest;
Permission ALLOWS Action;
Denial FORBIDS Action;
Role MAY_GRANT Permission;
Group MAY_ASSIGN Role;
AccessDecision RESULTS_FROM PolicyEvaluation;
AuditRecord RECORDS AccessDecision;

AccessControlFlow :=
    AccessRequest
    -> IdentifySubject
    -> AuthenticateOrResolveIdentity
    -> IdentifyResource
    -> IdentifyRequestedAction
    -> RetrieveApplicablePolicies
    -> ResolveRolesGroupsAndPermissions
    -> EvaluateConditionsRestrictionsAndClassification
    -> ResolvePolicyConflicts
    -> ProduceAccessDecision
    -> EnforceDecision
    -> RecordAuditAndProvenance
    -> MaintainPolicyState;

AccessRequest :=
    Subject
    + Resource
    + Action
    + Context;

Subject :=
    AgentRequestingAccessOrOperation;

Subject MAY_BE {
    User,
    Person,
    Organisation,
    ServiceAccount,
    SoftwareAgent,
    AIService
};

Resource :=
    ProtectedObjectOrCapability;

Resource MAY_BE {
    Document,
    Dataset,
    File,
    MetadataRecord,
    API,
    Service,
    System,
    Model,
    ResourceFragment
};

Action :=
    OperationRequestedOnResource;

Action MAY_BE {
    Read,
    View,
    Search,
    Download,
    Create,
    Update,
    Delete,
    Execute,
    Share,
    Publish,
    Administer
};

Identity :=
    CanonicalRepresentationOfSubject;

Credential :=
    EvidenceUsedToSupportAuthentication;

Authentication :=
    ProcessOfEstablishingOrVerifyingSubjectIdentity;

AuthenticationContext MAY_INCLUDE {
    AuthenticationMethod,
    AuthenticationTime,
    AssuranceLevel,
    DeviceContext
};

Authentication != AuthorisationByDefinition;

AuthenticatedSubject MAY_STILL_BE DeniedRequestedAction;

Authorisation :=
    ProcessOfDeterminingWhetherSubjectMayPerformActionOnResource;

AccessPolicy :=
    RuleSetGoverningAuthorisationDecision;

PolicyRule :=
    ConditionalStatementContributingToAccessDecision;

PolicyRule MAY_HAVE {
    SubjectScope,
    ResourceScope,
    ActionScope,
    Effect,
    Condition,
    Priority
};

PolicyEffect MAY_BE {
    Permit,
    Deny
};

Permission :=
    AuthorisationAllowingSpecifiedActionWithinDefinedScope;

Denial :=
    DecisionOrRuleForbiddingSpecifiedAction;

Restriction :=
    ConstraintLimitingAccessOrPermittedAction;

Condition :=
    ContextualRequirementThatMustBeSatisfiedForRuleToApply;

Condition MAY_INCLUDE {
    TimeWindow,
    LocationContext,
    DeviceTrust,
    NetworkContext,
    AuthenticationStrength,
    ResourceStatus
};

Role :=
    NamedCollectionOfPermissionsOrResponsibilities;

RoleBasedAccessControl :=
    Subject
    -> HAS_ROLE
    -> Role
    -> HAS_PERMISSION
    -> ActionOnResource;

RBAC MAY_INCLUDE {
    RoleAssignment,
    PermissionAssignment,
    RoleHierarchy
};

RoleHierarchy :=
    RelationshipWhereRoleMayInheritPermissionsFromAnotherRoleAccordingToPolicy;

PermissionInheritance SHOULD_BE ExplicitlyDefined;

Group :=
    CollectionOfSubjectsUsedForAdministrativeAssignment;

Group MAY_HAVE RolesOrPermissionsAccordingToPolicy;

AttributeBasedAccessControl :=
    DecisionBasedOnAttributesOfSubjectResourceActionAndEnvironment;

ABAC MAY_USE {
    SubjectAttributes,
    ResourceAttributes,
    ActionAttributes,
    EnvironmentAttributes
};

DiscretionaryAccessControl :=
    AccessModelWhereResourceOwnerOrAuthorisedControllerMayGrantPermissions;

MandatoryAccessControl :=
    AccessModelUsingSecurityLabelsClearancesAndMandatoryRules;

SecurityClassification :=
    ProtectionLevelAssignedToResource;

SecurityClassification MAY_BE {
    Public,
    Internal,
    Confidential,
    Restricted,
    CustomLevel
};

Clearance :=
    AuthorisedSecurityLevelAssociatedWithSubject;

IF MandatoryPolicyRequiresClearance
AND SubjectClearanceInsufficient
THEN AccessDecision := Deny;

LeastPrivilege :=
    PrincipleThatSubjectShouldReceiveOnlyPermissionsNecessaryForRequiredTasks;

DefaultDeny :=
    PolicyPrincipleWhereAccessIsDeniedUnlessExplicitlyPermitted;

IF NoApplicablePermitRule
AND PolicyUsesDefaultDeny
THEN AccessDecision := Deny;

DefaultAllow :=
    PolicyPrincipleWhereAccessIsAllowedUnlessExplicitlyDenied;

DefaultAllow SHOULD_BE UsedOnlyWhereGovernanceAndRiskPermit;

ExplicitDeny :=
    DenyRuleThatMayOverridePermitAccordingToPolicyCombiningAlgorithm;

PolicyCombiningAlgorithm :=
    RuleForResolvingMultipleApplicablePolicyEffects;

CombiningAlgorithm MAY_BE {
    DenyOverrides,
    PermitOverrides,
    FirstApplicable,
    PriorityBased,
    OnlyOneApplicable
};

DenyOverrides :=
    IF AnyApplicableRuleDenies
    THEN FinalDecision := Deny
    UNLESS higher_order_policy_explicitly_defines_otherwise;

PermitOverrides :=
    IF AnyApplicableRulePermits
    THEN FinalDecision MAY_BE Permit
    ACCORDING_TO defined_policy;

PriorityBased :=
    HighestPriorityApplicableRuleDeterminesOrContributesToDecision;

PolicyConflict :=
    ApplicableRulesProduceIncompatibleEffects;

ConflictResolution SHOULD_BE DeterministicAndAuditable;

AccessDecision :=
    ResultOfAuthorisationEvaluation;

AccessDecision MAY_BE {
    Permit,
    Deny,
    Conditional,
    Indeterminate,
    NotApplicable
};

ConditionalDecision :=
    AccessAllowedOnlyIfSpecifiedObligationsOrConditionsAreSatisfied;

Indeterminate :=
    DecisionCannotBeReliablyComputedBecauseOfMissingInvalidOrConflictingInformation;

NotApplicable :=
    EvaluatedPolicyDoesNotApplyToRequest;

DecisionReason :=
    ExplanationOfRulesConditionsAndEvidenceLeadingToDecision;

ExplainableAccessDecision SHOULD_PRESERVE DecisionReasonWherePolicyAllows;

PolicyScope :=
    ResourcesSubjectsActionsOrContextsToWhichPolicyApplies;

ResourceScope MAY_BE {
    SingleResource,
    ResourceType,
    Collection,
    Hierarchy,
    Tenant,
    Namespace
};

Permission MAY_INHERIT ThroughResourceHierarchyAccordingToExplicitPolicy;

Inheritance MUST_NOT_BE AssumedWithoutPolicySemantics;

ResourceOwner MAY_HAVE AdministrativeAuthority
BUT Ownership DOES_NOT AutomaticallyImplyUnlimitedAccessInMandatoryPolicySystems;

AccessControl MAY_REFERENCE OwnershipMetadata;

AccessControl MAY_REFERENCE LicensingMetadata;

AccessControl MAY_REFERENCE CopyrightMetadata;

RightsOrLicence MAY_LIMIT WhatAccessPolicyCanLegitimatelyPermit;

Embargo :=
    TimeBoundAccessRestriction;

IF CurrentTimeBeforeEmbargoEnd
THEN PublicAccess MAY_BE Denied;

TemporaryPermission :=
    PermissionValidForDefinedTimeWindow;

PermissionExpiry SHOULD_TRIGGER RecalculationOrRevocation;

Delegation :=
    AuthorisedTransferOfLimitedAccessAuthorityFromOneSubjectToAnother;

DelegatedPermission MUST_NOT ExceedDelegatorAuthorityAccordingToPolicy;

Revocation :=
    RemovalOrInvalidationOfPermissionRoleCredentialOrDelegation;

Revocation SHOULD_PROPAGATE ToAffectedAccessDecisionsAndCaches;

AccessControlList :=
    ResourceAssociatedListOfSubjectsOrGroupsAndTheirPermissions;

ACL MAY_DEFINE {
    Subject,
    Permission,
    Denial
};

Capability :=
    PossessionOfUnforgeableOrControlledTokenGrantingSpecificAuthority;

CapabilityBasedAccessControl :=
    AccessBasedOnValidCapabilityRatherThanOnlyIdentityOrRole;

PolicyVersion :=
    IdentifiedRevisionOfAccessPolicy;

PolicyHistory SHOULD_PRESERVE PreviousVersionsWhereAuditabilityRequires;

AccessPolicyChange MAY_INCLUDE {
    AddRule,
    RemoveRule,
    ModifyPermission,
    ModifyRole,
    ModifyCondition,
    ChangeCombiningAlgorithm
};

BreakingAccessChange :=
    PolicyChangeThatExpandsOrReducesEffectiveAccess;

BreakingAccessChange SHOULD_BE {
    Authorised,
    Audited,
    Tested
};

AccessValidation MAY_CHECK {
    SubjectIdentity,
    ResourceIdentity,
    ActionValidity,
    PolicySyntax,
    PermissionScope,
    RoleAssignment,
    ConditionValidity
};

IF SubjectIdentityUnresolved
THEN AccessDecision SHOULD_NOT_BE PermitUnderIdentityDependentPolicy;

IF ResourceIdentityUnresolved
THEN Decision MAY_BE IndeterminateOrDenyAccordingToPolicy;

AccessControlCompleteness :=
    DegreeToWhichRequiredPoliciesPermissionsRolesAndConditionsAreDefined;

AccessControlConsistency :=
    DegreeToWhichRulesAndAssignmentsProduceCoherentExpectedDecisions;

AccessControlIntegrity :=
    PreservationOfAuthorisedPolicyStateAndDecisionEvidence;

AccessControlQuality MAY_INCLUDE {
    Completeness,
    Consistency,
    Integrity,
    LeastPrivilegeAlignment,
    Auditability
};

AuditRecord :=
    RecordOfAccessRequestDecisionOrPolicyChange;

AccessAuditRecord MAY_INCLUDE {
    SubjectIdentifier,
    ResourceIdentifier,
    Action,
    Decision,
    Timestamp,
    PolicyVersion,
    DecisionReason
};

AuditTrail :=
    OrderedCollectionOfAccessAuditRecords;

SuccessfulAndDeniedAccess MAY_BOTH_BE AuditedAccordingToPolicy;

AccessProvenance MAY_INCLUDE {
    PolicySource,
    PolicyVersion,
    Evaluator,
    Timestamp,
    AuthenticationContext
};

AccessConfidence :=
    EstimatedSupportForInferredOrDerivedAccessMetadata;

AccessControlMetadata SHOULD_PREFER DeterministicAuthoritativePolicyOverProbabilisticInferenceForEnforcement;

AI MAY_SUPPORT {
    PolicyAnalysis,
    RoleRecommendation,
    AnomalyDetection,
    PermissionReview,
    NaturalLanguagePolicyExtraction
};

AIGeneratedPolicySuggestion SHOULD_NOT BecomeEnforcedPolicyWithoutRequiredAuthorisationAndValidation;

AnomalousAccess :=
    AccessPatternDifferingFromExpectedBehaviour;

AnomalyDetection MAY_TRIGGER Review
BUT SHOULD_NOT AloneDetermineAuthorisationUnlessPolicyExplicitlyUsesRiskSignals;

RiskBasedAccessControl :=
    AuthorisationConsideringDynamicRiskScoreOrContext;

RiskSignal MAY_INCLUDE {
    DeviceRisk,
    NetworkRisk,
    BehaviouralAnomaly,
    AuthenticationRisk
};

RiskBasedDecision SHOULD_PRESERVE ExplainablePolicyBasisWhereRequired;

AdministrativeMetadata MAY_STORE AccessControlPoliciesAndAssignments;

ProvenanceMetadata MAY_RECORD PolicyChangesAndDecisionHistory;

StructuralMetadata MAY_DEFINE ResourceHierarchyUsedForScopedPermissions;

MetadataRepository MAY_ENFORCE AccessControlAtRecordFieldOrResourceLevel;

MetadataRegistry MAY_REGISTER AccessPropertiesRolesActionsAndPolicyTypes;

KnowledgeGraph MAY_REPRESENT:
    Subject
    -> HAS_ROLE
    -> Role;

Role
    -> HAS_PERMISSION
    -> Permission;

Permission
    -> APPLIES_TO
    -> Resource;

AccessGraph SHOULD_PRESERVE ScopeConditionsAndPolicyVersion;

RDF MAY_REPRESENT AccessRelationshipsAsTypedStatements;

JSONLD MAY_SERIALISE LinkedAccessControlMetadata;

Search MUST_FILTER ResultsAccordingToEffectiveAccessPolicy;

SearchIndex MAY_CONTAIN RestrictedResourceMetadata
BUT QueryResults MUST_NOT LeakProtectedInformationBeyondPolicy;

SemanticSearch MUST_APPLY AccessControlBeforeReturningProtectedContent;

RAG MUST_APPLY AccessControlBeforeAddingProtectedResourceToModelContext;

AccessControlledRAG SHOULD_PRESERVE {
    SubjectIdentityContext,
    ResourceEligibility,
    PolicyDecision,
    Provenance
};

Caching MAY_CREATE AccessLeakRiskIfCachedResultsIgnoreSubjectSpecificPermissions;

AccessAwareCache SHOULD_INCLUDE RelevantAuthorisationContextOrAvoidUnsafeSharing;

AccessControlSecurity MAY_INCLUDE {
    PolicyIntegrity,
    CredentialProtection,
    SessionSecurity,
    AuditProtection,
    ChangeAuthorisation
};

PolicyAdministration SHOULD_BE RestrictedToAuthorisedAdministrativeSubjects;

SeparationOfDuties :=
    PrincipleRequiringMultipleRolesOrAgentsForSensitiveActions;

SensitiveAdministrativeAction MAY_REQUIRE ApprovalFromMultipleAuthorisedAgents;

MachineReadableAccessControl SHOULD_PRESERVE {
    SubjectIdentifier,
    ResourceIdentifier,
    Action,
    PolicyIdentifier,
    PolicyVersion,
    Roles,
    Permissions,
    Restrictions,
    Conditions,
    Decision,
    Provenance
};

# ---------- SEMANTIC REASONING ----------
IF AdministrativeMetadataDeterminesWhetherSubjectMayPerformActionOnResource
THEN AccessControlClassification := supported;

IF AuthenticationSucceeds
THEN Identity MAY_BE Established
BUT Access MUST_STILL_BE Authorised;

IF ExplicitDenyApplies
AND CombiningAlgorithmIsDenyOverrides
THEN AccessDecision := Deny;

IF NoPermitApplies
AND DefaultDenyEnabled
THEN AccessDecision := Deny;

IF PermissionExpired
THEN Permission MUST_NOT AuthoriseNewAccess;

IF RoleRevokedFromSubject
THEN RoleDerivedPermissions SHOULD_NO_LONGER Apply;

IF ResourceClassificationExceedsSubjectClearanceUnderMandatoryPolicy
THEN AccessDecision := Deny;

IF AccessPolicyChanges
THEN CachedAuthorisationDecisions MAY_REQUIRE Invalidation;

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE {
    "access control" ~= "resource access control";
    "authorisation" ~= "authorization";
    "access policy" ~= "authorisation policy";
    "permission" ~= "access permission" WHEN access_context;
    "denial" ~= "access denial";
    "role-based access control" ~= "RBAC";
    "attribute-based access control" ~= "ABAC";
    "access control list" ~= "ACL";
}

# ---------- QUERY FLOW ----------
QUERY(q) ->
    NORMALISE(q) ->
    IDENTIFY_SUBJECT(q) ->
    RESOLVE_IDENTITY_AND_AUTHENTICATION_CONTEXT(q) ->
    IDENTIFY_RESOURCE(q) ->
    IDENTIFY_REQUESTED_ACTION(q) ->
    RETRIEVE_APPLICABLE_POLICIES(q) ->
    RESOLVE_ROLES_GROUPS_AND_PERMISSIONS(q) ->
    EVALUATE_CONDITIONS_CLASSIFICATION_AND_RESTRICTIONS(q) ->
    RESOLVE_POLICY_CONFLICTS(q) ->
    PRODUCE_ACCESS_DECISION(q) ->
    RECORD_DECISION_PROVENANCE(q) ->
    RETURN_AUTHORISED_RESULT_OR_DENIAL;

# ---------- CONFIDENCE ----------
CONFIDENCE(assertion) :=
    weighted_mean(
        identity_strength,
        policy_authority,
        policy_consistency,
        scope_resolution,
        provenance_quality,
        contextual_relevance
    );

CONFIDENCE >= 0.90 => HIGH;
CONFIDENCE >= 0.70 AND < 0.90 => MODERATE;
CONFIDENCE < 0.70 => REVIEW;

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION {
    primary_entity: AccessControl;
    ontology: AccessControlOntology;
    parse_entities: true;
    parse_relationships: true;
    preserve_relationship_direction: true;
    resolve_semantic_equivalence: true;
    execute_reasoning_rules: true;
    apply_confidence_weighting: true;
    preserve_provenance: true;
    enforce_access_policy: true;
    default_to_deny_when_required: true;
}

# ---------- UPDATE MODEL ----------
UPDATE_MODEL {
    new_policy:
        assign_policy_identifier
        -> define_scope
        -> define_subject_resource_and_action_rules
        -> define_effects_conditions_and_priority
        -> validate
        -> authorise
        -> version
        -> integrate;

    permission_change:
        identify_subject_or_role
        -> identify_resource_scope
        -> add_modify_or_revoke_permission
        -> validate_least_privilege
        -> audit_change
        -> invalidate_affected_caches
        -> integrate;

    policy_revision:
        preserve_previous_version
        -> apply_authorised_changes
        -> detect_breaking_access_change
        -> test_effective_decisions
        -> audit
        -> invalidate_cached_decisions
        -> regenerate_flow_hash;

    access_request:
        authenticate_or_resolve_identity
        -> evaluate_policy
        -> enforce_decision
        -> record_audit
        -> return_result;

    conflict:
        preserve_policy_sources
        -> apply_combining_algorithm
        -> preserve_decision_reason
        -> flag_review_if_indeterminate;
}

# ---------- FLOW HASH ----------
FLOW_HASH_INPUT :=
    DOMAIN
    + SUBDOMAIN
    + ONTOLOGY
    + AccessEntity
    + IdentityEntity
    + PolicyEntity
    + AuditEntity
    + AccessControl
    + AccessDecision
    + PolicyCombiningAlgorithm
    + RELATIONSHIPS
    + SEMANTIC_REASONING
    + SEMANTIC_EQUIVALENCE
    + UPDATE_MODEL;

FLOW_HASH :=
    HASH(FLOW_HASH_INPUT);

# ---------- TERMINAL ----------
AccessControlOntology
    -> IdentifySubjectIdentityAndAuthenticationContext
    -> IdentifyProtectedResourceAndRequestedAction
    -> RetrieveApplicablePoliciesRolesGroupsAndPermissions
    -> EvaluateSecurityClassificationConditionsAndRestrictions
    -> ResolvePolicyConflictsUsingDefinedCombiningRules
    -> ProducePermitDenyConditionalOrIndeterminateDecision
    -> EnforceLeastPrivilegeAndDefaultPolicy
    -> RecordDecisionReasonAuditAndProvenance
    -> InvalidateAccessWhenRolesPermissionsOrPoliciesChange
    -> ApplyAuthorisationToSearchRAGAndKnowledgeAccess
    -> ProtectRestrictedMetadataAndResourceContent
    -> MaintainVersionedPolicyAndDecisionHistory
    -> MaintainReliableAccessControlKnowledge;

END FLOW