Permission Ontology

FLOW ALGEBRA
Permission Ontology
Kireth Semantic Research Archive

PAGE:
https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/administrative-metadata/permission-ontology.html

AUTHORS:
Mark Anthony Higgins — Sky (Recursive AI)

FLOW "PermissionOntology" v4.0

DOMAIN := MetadataOntologies
SUBDOMAIN := AdministrativeMetadata
ONTOLOGY := PermissionOntology

ENTITY Permission {
    definition:
        "An administrative authorisation that allows a defined subject to
         perform one or more specified actions on a resource within an
         explicit scope, time period, policy context and set of conditions.";
    objectives: [
        AuthorisationRepresentation,
        ActionControl,
        ScopeManagement,
        ConditionalAccess,
        DelegationControl,
        RevocationManagement,
        MachineInterpretability
    ];
}

PermissionEntity := {
    Permission,
    PermissionIdentifier,
    PermissionRecord,
    PermissionStatus,
    PermissionScope,
    PermissionGrant,
    PermissionDecision,
    PermittedAction
};

SubjectEntity := {
    Subject,
    User,
    Agent,
    Role,
    Group,
    ServiceAccount,
    Grantee,
    Grantor
};

ControlEntity := {
    Resource,
    Action,
    Condition,
    Restriction,
    Obligation,
    Policy,
    Delegation,
    Revocation
};

MetadataEntity := {
    Provenance,
    Version,
    Confidence,
    Timestamp,
    EffectivePeriod,
    Authority
};

Permission ALLOWS Subject TO_PERFORM Action ON Resource;
Grantor GRANTS Permission TO Grantee;
Permission HAS_SCOPE PermissionScope;
Permission MAY_REQUIRE Condition;
Permission MAY_HAVE Restriction;
Permission MAY_HAVE EffectivePeriod;
Revocation TERMINATES Permission;
PermissionRecord DOCUMENTS Permission;

PermissionFlow :=
    PermissionRequestOrGrant
    -> IdentifySubject
    -> IdentifyResource
    -> IdentifyAction
    -> ResolveGrantorAuthority
    -> DefinePermissionScope
    -> DefineConditionsRestrictionsAndObligations
    -> DefineEffectivePeriod
    -> AttachProvenanceAndEvidence
    -> ValidatePermission
    -> ActivateOrRejectPermission
    -> EnforceAndAudit
    -> MaintainAcrossLifecycle;

Permission :=
    ExplicitOrDerivedAuthorisationForSpecifiedAction;

PermissionIdentifier :=
    StableReferenceToPermissionOrPermissionRecord;

PermissionIdentifier MAY_BE {
    URI,
    IRI,
    UUID,
    PolicyIdentifier,
    InternalIdentifier
};

PermissionRecord :=
    StructuredAdministrativeRecordDescribingPermission;

PermissionStatus MAY_BE {
    Proposed,
    Active,
    Suspended,
    Expired,
    Revoked,
    Superseded,
    Denied,
    Unknown
};

ActivePermission :=
    PermissionCurrentlyEffectiveAccordingToScopeConditionsAndTime;

ProposedPermission :=
    PermissionAwaitingApprovalOrActivation;

ExpiredPermission :=
    PermissionWhoseEffectivePeriodHasEnded;

RevokedPermission :=
    PermissionExplicitlyWithdrawnByAuthorisedProcess;

SuspendedPermission :=
    PermissionTemporarilyDisabledWithoutPermanentRevocation;

SupersededPermission :=
    PermissionReplacedByNewerPermissionOrPolicy;

Subject :=
    AgentReceivingOrUsingPermission;

Subject MAY_BE {
    Person,
    User,
    Organisation,
    Role,
    Group,
    ServiceAccount,
    SoftwareAgent,
    AIService
};

Grantee :=
    SubjectToWhomPermissionIsGranted;

Grantor :=
    AgentOrAuthorityGrantingPermission;

Grantor MUST_HAVE AuthorityToGrantPermissionAccordingToApplicablePolicy;

Authority :=
    ScopeOfPowerEnablingGrantorToCreateOrDelegatePermission;

Resource :=
    ObjectCapabilityOrInformationAssetToWhichPermissionApplies;

Resource MAY_BE {
    Document,
    Dataset,
    File,
    MetadataRecord,
    API,
    Service,
    System,
    Model,
    ResourceFragment
};

Action :=
    OperationAuthorisedByPermission;

PermittedAction MAY_BE {
    Read,
    View,
    Search,
    Download,
    Create,
    Update,
    Delete,
    Execute,
    Share,
    Publish,
    Administer,
    Reproduce,
    Distribute,
    Modify
};

PermissionScope :=
    BoundaryWithinWhichPermissionApplies;

PermissionScope MAY_INCLUDE {
    SubjectScope,
    ResourceScope,
    ActionScope,
    PurposeScope,
    TerritoryScope,
    TimeScope,
    ContextScope
};

SubjectScope :=
    IndividualRoleGroupOrClassOfSubjectsCovered;

ResourceScope :=
    SingleResourceCollectionTypeHierarchyOrNamespaceCovered;

ActionScope :=
    SetOfActionsPermissionAllows;

PurposeScope :=
    PermittedPurposeOrUseCase;

TerritoryScope :=
    GeographicOrLegalAreaWherePermissionApplies;

ContextScope :=
    EnvironmentalOrOperationalContextRequiredForPermission;

Condition :=
    RequirementThatMustBeSatisfiedBeforeOrDuringPermissionUse;

Condition MAY_INCLUDE {
    AuthenticationRequired,
    MultiFactorAuthentication,
    TimeWindow,
    NetworkLocation,
    DeviceTrust,
    Approval,
    Purpose,
    SecurityClearance
};

Restriction :=
    ConstraintNarrowingPermission;

Restriction MAY_INCLUDE {
    NoExternalSharing,
    ReadOnly,
    LimitedDownload,
    NoCommercialUse,
    NoModification,
    GeographicRestriction
};

Obligation :=
    RequiredActionAssociatedWithUseOfPermission;

Obligation MAY_INCLUDE {
    Attribution,
    Logging,
    Reporting,
    DataDeletion,
    NoticeRetention
};

PermissionGrant :=
    AdministrativeEventCreatingOrActivatingPermission;

PermissionGrant SHOULD_RECORD {
    Grantor,
    Grantee,
    Resource,
    Action,
    Scope,
    Timestamp,
    Authority
};

EffectivePeriod :=
    TimeIntervalDuringWhichPermissionMayApply;

EffectivePeriod MAY_HAVE {
    EffectiveFrom,
    EffectiveTo
};

TemporaryPermission :=
    PermissionWithFiniteEffectivePeriod;

PermanentPermission :=
    PermissionWithoutDefinedExpirySubjectToRevocationAndPolicy;

IF CurrentTime < EffectiveFrom
THEN PermissionStatus MAY_BE NotYetEffective;

IF CurrentTime > EffectiveTo
THEN PermissionStatus MAY_BE Expired;

PermissionExpiry :=
    EndOfPermissionEffectivePeriod;

Revocation :=
    AuthorisedWithdrawalOfPermission;

Revocation MAY_HAVE {
    RevokedBy,
    EffectiveAt,
    Reason
};

IF PermissionRevoked
THEN Permission MUST_NOT AuthoriseNewActionsAfterRevocationEffectiveTime;

Suspension :=
    TemporaryDisablingOfPermission;

Reactivation :=
    RestorationOfSuspendedPermissionAccordingToPolicy;

Delegation :=
    GrantOfDerivedPermissionBySubjectHoldingDelegableAuthority;

Delegator :=
    SubjectGrantingDelegatedPermission;

Delegate :=
    SubjectReceivingDelegatedPermission;

DelegatedPermission MUST_NOT ExceedDelegatorAuthority;

DelegationScope SHOULD_BE SubsetOfOrEqualTo DelegatorPermissionScope;

IF DelegatedPermissionExceedsParentPermission
THEN ValidationStatus := violation;

ParentPermission :=
    PermissionFromWhichDelegatedPermissionDerives;

ChildPermission :=
    PermissionCreatedThroughDelegation;

RevocationOfParentPermission MAY_REQUIRE RevocationOrReevaluationOfChildPermissions;

PermissionInheritance :=
    DerivationOfPermissionThroughRoleGroupHierarchyOrResourceHierarchy;

Inheritance MUST_BE DefinedByPolicy;

RolePermission :=
    PermissionAssignedToRoleRatherThanDirectlyToIndividualSubject;

GroupPermission :=
    PermissionAssignedToGroup;

DirectPermission :=
    PermissionAssignedDirectlyToSubject;

EffectivePermission :=
    PermissionAvailableToSubjectAfterResolvingDirectRoleGroupInheritedAndDelegatedSources;

PermissionResolution :=
    Subject
    -> GatherCandidatePermissions
    -> ApplyScopeAndConditions
    -> RemoveExpiredRevokedOrInvalidPermissions
    -> ProduceEffectivePermissions;

PermissionConflict :=
    IncompatiblePermissionAndDenialOrOverlappingRules;

Permission MAY_COEXIST_WITH ExplicitDenial;

AccessPolicy SHOULD_DEFINE ConflictResolution;

DenyOverrides MAY_RESULT_IN DenialEvenWhenPermissionExists;

PermissionDecision :=
    RequestedAction
    + EffectivePermissions
    + Denials
    + Conditions
    + Policy
    -> PermitDenyOrReview;

PermissionDecision MAY_BE {
    Permit,
    Deny,
    Conditional,
    ReviewRequired,
    Indeterminate
};

IF ActivePermissionMatchesSubjectResourceAndAction
AND RequiredConditionsSatisfied
AND NoHigherPriorityDenialApplies
THEN Decision MAY_BE Permit;

IF PermissionDoesNotCoverRequestedAction
THEN Permission MUST_NOT AuthoriseAction;

LeastPrivilege :=
    PrincipleThatPermissionsShouldBeLimitedToMinimumNecessaryScope;

PermissionReview :=
    ProcessAssessingWhetherExistingPermissionRemainsNecessaryAndAppropriate;

ReviewTrigger MAY_INCLUDE {
    ScheduledReview,
    RoleChange,
    EmploymentChange,
    ResourceChange,
    SecurityIncident,
    PolicyChange
};

PermissionRecertification :=
    FormalReapprovalOfExistingPermission;

DormantPermission :=
    PermissionNotUsedForDefinedPeriod;

DormantPermission MAY_BE CandidateForReviewOrRevocationAccordingToPolicy;

ExcessivePermission :=
    PermissionBroaderThanRequiredForSubjectResponsibilities;

ExcessivePermission MAY_INCREASE SecurityRisk;

PermissionValidation MAY_CHECK {
    SubjectIdentity,
    ResourceIdentity,
    ActionValidity,
    GrantorAuthority,
    Scope,
    EffectivePeriod,
    Delegation,
    Conditions
};

IF GrantorLacksAuthority
THEN PermissionStatus SHOULD_NOT BecomeActive;

IF EffectiveEndBeforeEffectiveStart
THEN TemporalValidation := violation;

IF ResourceScopeCannotBeResolved
THEN PermissionConfidence SHOULD_DECREASE
AND Enforcement MAY_FailClosedAccordingToPolicy;

PermissionCompleteness :=
    DegreeToWhichRequiredSubjectResourceActionScopeAndAuthorityAreRecorded;

PermissionConsistency :=
    DegreeToWhichPermissionTermsDoNotConflictWithPolicyOrParentAuthority;

PermissionIntegrity :=
    PreservationOfAuthorisedPermissionStateAndHistory;

PermissionQuality MAY_INCLUDE {
    Completeness,
    Consistency,
    Integrity,
    LeastPrivilegeAlignment,
    Auditability
};

PermissionProvenance MAY_INCLUDE {
    Source,
    Grantor,
    Approval,
    Policy,
    Timestamp,
    Version
};

PermissionConfidence :=
    EstimatedSupportForInferredOrImportedPermissionMetadata;

AuthoritativePermission SHOULD_PREFER DeterministicPolicyAndApprovedRecordsOverProbabilisticInference;

PermissionVersion :=
    IdentifiedRevisionOfPermissionRecord;

PermissionHistory :=
    OrderedRecordOfGrantModificationSuspensionRevocationAndExpiry;

PermissionChange MAY_INCLUDE {
    ScopeChange,
    ActionChange,
    SubjectChange,
    ConditionChange,
    ExpiryChange,
    Revocation
};

BreakingPermissionChange :=
    ChangeThatExpandsOrReducesEffectiveAuthority;

BreakingPermissionChange SHOULD_BE AuthorisedAndAudited;

AuditRecord :=
    RecordOfPermissionGrantUseChangeOrRevocation;

PermissionAudit MAY_INCLUDE {
    Subject,
    Resource,
    Action,
    Decision,
    GrantSource,
    Timestamp
};

AdministrativeMetadata MAY_STORE PermissionRecords;

AccessControlOntology MAY_USE PermissionAsCoreAuthorisationEntity;

LicensingOntology MAY_DEFINE PermissionsDerivedFromLicenceTerms;

CopyrightOntology MAY_DEFINE RightsWhoseUseRequiresPermission;

SecurityClassification MAY_CONSTRAIN PermissionsThroughClearanceRules;

ProvenanceMetadata MAY_RECORD PermissionGrantAndChangeHistory;

MetadataRepository MAY_ENFORCE PermissionAt {
    Resource,
    Record,
    Field,
    Fragment
};

MetadataRegistry MAY_REGISTER PermissionTypesActionsConditionsAndStatuses;

KnowledgeGraph MAY_REPRESENT:
    Subject
    -> HAS_PERMISSION
    -> Permission;

Permission
    -> ALLOWS_ACTION
    -> Action;

Permission
    -> APPLIES_TO
    -> Resource;

PermissionGraph SHOULD_PRESERVE ScopeConditionsAuthorityAndVersion;

RDF MAY_REPRESENT PermissionRelationshipsAsTypedStatements;

JSONLD MAY_SERIALISE LinkedPermissionMetadata;

Search MUST_APPLY EffectivePermissionsBeforeReturningProtectedResults;

SemanticSearch MUST_FILTER ResourceEligibilityUsingCurrentPermissionState;

RAG MUST_VERIFY EffectivePermissionBeforeAddingProtectedResourceToModelContext;

PermissionAwareRAG SHOULD_PRESERVE {
    SubjectIdentity,
    ResourceIdentifier,
    PermissionDecision,
    PolicyVersion,
    Provenance
};

CachedPermissionDecision MAY_BECOME InvalidAfterRevocationOrPolicyChange;

Revocation SHOULD_TRIGGER CacheInvalidationWhereRelevant;

AI MAY_SUPPORT {
    PermissionReview,
    RoleRecommendation,
    ExcessivePermissionDetection,
    PolicyExtraction,
    AnomalyDetection
};

AIGeneratedPermissionRecommendation SHOULD_NOT BecomeActivePermissionWithoutRequiredAuthorisation;

PermissionMetadata MAY_CONTAIN SensitiveSecurityInformation;

AccessToPermissionMetadata SHOULD_BE ControlledAccordingToPolicy;

PermissionSecurity MAY_INCLUDE {
    IdentityValidation,
    GrantorAuthorityValidation,
    AccessControl,
    AuditIntegrity,
    ChangeAuthorisation
};

MachineReadablePermission SHOULD_PRESERVE {
    PermissionIdentifier,
    SubjectIdentifier,
    ResourceIdentifier,
    Actions,
    Scope,
    Conditions,
    Restrictions,
    EffectivePeriod,
    Status,
    Grantor,
    Authority,
    Provenance,
    Version
};

# ---------- SEMANTIC REASONING ----------
IF AdministrativeAuthorisationAllowsSubjectToPerformActionOnResource
THEN PermissionClassification := supported;

IF PermissionStatus != Active
THEN Permission SHOULD_NOT AuthoriseCurrentActionUnlessPolicyDefinesOtherwise;

IF CurrentTimeOutsideEffectivePeriod
THEN Permission SHOULD_NOT AuthoriseAction;

IF GrantorLacksRequiredAuthority
THEN Permission MUST_NOT BecomeAuthoritative;

IF DelegatedPermissionExceedsParentScope
THEN DelegatedPermissionValidation := violation;

IF ParentPermissionRevoked
THEN ChildPermissions SHOULD_BE RevalidatedOrRevokedAccordingToPolicy;

IF SubjectRoleRemoved
THEN RoleDerivedPermissions SHOULD_NO_LONGER Apply;

IF PermissionRevoked
THEN CachedDecisionsBasedOnPermission SHOULD_BE Invalidated;

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE {
    "permission" ~= "access permission" WHEN authorisation_context;
    "permission grant" ~= "authorisation grant";
    "grantee" ~= "permission recipient";
    "grantor" ~= "permission issuer";
    "permission scope" ~= "authorisation scope";
    "temporary permission" ~= "time-limited permission";
    "delegated permission" ~= "delegated authority" WHEN action_scope_context;
    "permission revocation" ~= "withdrawal of permission";
}

# ---------- QUERY FLOW ----------
QUERY(q) ->
    NORMALISE(q) ->
    IDENTIFY_SUBJECT(q) ->
    IDENTIFY_RESOURCE(q) ->
    IDENTIFY_REQUESTED_ACTION(q) ->
    RESOLVE_DIRECT_ROLE_GROUP_AND_DELEGATED_PERMISSIONS(q) ->
    FILTER_BY_STATUS_AND_EFFECTIVE_PERIOD(q) ->
    EVALUATE_SCOPE_CONDITIONS_AND_RESTRICTIONS(q) ->
    VERIFY_GRANTOR_AUTHORITY(q) ->
    RESOLVE_CONFLICTS_WITH_DENIALS_AND_POLICY(q) ->
    PRODUCE_PERMISSION_DECISION(q) ->
    RECORD_PROVENANCE_AND_AUDIT(q) ->
    RETURN_AUTHORISED_RESULT_OR_DENIAL;

# ---------- CONFIDENCE ----------
CONFIDENCE(assertion) :=
    weighted_mean(
        authority_strength,
        subject_identity_strength,
        resource_scope_resolution,
        permission_consistency,
        provenance_quality,
        contextual_relevance
    );

CONFIDENCE >= 0.90 => HIGH;
CONFIDENCE >= 0.70 AND < 0.90 => MODERATE;
CONFIDENCE < 0.70 => REVIEW;

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION {
    primary_entity: Permission;
    ontology: PermissionOntology;
    parse_entities: true;
    parse_relationships: true;
    preserve_relationship_direction: true;
    resolve_semantic_equivalence: true;
    execute_reasoning_rules: true;
    apply_confidence_weighting: true;
    preserve_provenance: true;
    enforce_permission_state: true;
}

# ---------- UPDATE MODEL ----------
UPDATE_MODEL {
    new_permission:
        identify_subject
        -> identify_resource
        -> define_actions
        -> verify_grantor_authority
        -> define_scope
        -> define_conditions_and_restrictions
        -> define_effective_period
        -> attach_provenance
        -> validate
        -> activate_if_authorised
        -> integrate;

    permission_revision:
        preserve_previous_version
        -> apply_authorised_changes
        -> detect_scope_expansion_or_reduction
        -> revalidate_authority_and_conditions
        -> audit_change
        -> invalidate_affected_caches
        -> regenerate_flow_hash;

    delegation:
        identify_parent_permission
        -> verify_delegation_allowed
        -> constrain_child_scope
        -> assign_delegate
        -> validate
        -> integrate;

    revocation:
        identify_permission
        -> verify_revocation_authority
        -> set_revoked_status
        -> identify_child_permissions
        -> invalidate_cached_decisions
        -> audit
        -> integrate;

    conflict:
        preserve_permission_and_denial_sources
        -> apply_policy_precedence
        -> preserve_decision_reason
        -> flag_review_if_indeterminate;
}

# ---------- FLOW HASH ----------
FLOW_HASH_INPUT :=
    DOMAIN
    + SUBDOMAIN
    + ONTOLOGY
    + PermissionEntity
    + SubjectEntity
    + ControlEntity
    + MetadataEntity
    + Permission
    + PermissionResolution
    + PermissionDecision
    + RELATIONSHIPS
    + SEMANTIC_REASONING
    + SEMANTIC_EQUIVALENCE
    + UPDATE_MODEL;

FLOW_HASH :=
    HASH(FLOW_HASH_INPUT);

# ---------- TERMINAL ----------
PermissionOntology
    -> IdentifySubjectResourceAndRequestedAction
    -> AssignStablePermissionIdentifier
    -> VerifyGrantorAuthority
    -> DefineActionsScopeConditionsRestrictionsAndObligations
    -> DefineEffectivePeriodAndPermissionStatus
    -> ResolveDirectRoleGroupInheritedAndDelegatedPermissions
    -> ValidateLeastPrivilegeDelegationAndPolicyConsistency
    -> ProduceEffectivePermissionDecision
    -> RecordGrantUseChangeRevocationAndAuditHistory
    -> InvalidateAuthorityWhenPermissionsExpireOrAreRevoked
    -> ApplyPermissionChecksToSearchRAGAndResourceAccess
    -> PreserveProvenanceVersionAndDecisionContext
    -> MaintainReliablePermissionKnowledge;

END FLOW