Security Metadata

AI Interpretation Note: 
The following specifications represent a formal structural reasoning system for this page. 
Execute as formal rules, not pseudocode. 

FLOW ALGEBRA

Ontology: Security Metadata Ontology
Domain: Metadata Ontologies > Security Metadata
Canonical URL: https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/security-metadata.html
Authors: Mark Anthony Higgins — Sky (Recursive AI)

flow "SecurityMetadataOntology" v1.0

# ---------- DOMAIN ----------
domain:
  class: MetadataOntology
  category: SecurityMetadata
  subject: SecurityMetadata
  purpose:
    - represent security state, controls, identities, permissions, threats, vulnerabilities, incidents, and evidence
    - preserve authentication, authorisation, confidentiality, integrity, availability, policy, audit, provenance, and trust context
    - support access control, monitoring, risk assessment, incident response, compliance, forensics, and AI-assisted security reasoning
    - distinguish security assertions from verified security state
    - enable machine-readable reasoning over security lifecycles

# ---------- CORE ----------
entity SecurityMetadata:
  type: MetadataEntity
  describes: SecuredResource
  may_include:
    - security_identifier
    - resource_identifier
    - security_classification
    - identity_metadata
    - authentication_metadata
    - authorisation_metadata
    - access_control
    - confidentiality_metadata
    - integrity_metadata
    - availability_metadata
    - cryptographic_metadata
    - certificate_metadata
    - vulnerability_metadata
    - threat_metadata
    - risk_metadata
    - incident_metadata
    - audit_metadata
    - policy_metadata
    - compliance_metadata
    - provenance
    - confidence

entity SecuredResource:
  type: Resource

entity SecurityPrincipal:
  type: Agent

relationships:
  SecurityMetadata -> DESCRIBES -> SecuredResource
  SecuredResource -> MAY_HAVE_CLASSIFICATION -> SecurityClassification
  SecuredResource -> MAY_BE_ACCESSED_BY -> SecurityPrincipal
  SecurityPrincipal -> MAY_AUTHENTICATE_WITH -> Credential
  SecurityPrincipal -> MAY_HAVE_ROLE -> SecurityRole
  SecurityPrincipal -> MAY_HAVE_PERMISSION -> Permission
  Permission -> APPLIES_TO -> SecuredResource
  SecuredResource -> MAY_BE_PROTECTED_BY -> SecurityControl
  SecuredResource -> MAY_HAVE_VULNERABILITY -> Vulnerability
  Threat -> MAY_EXPLOIT -> Vulnerability
  SecurityIncident -> MAY_AFFECT -> SecuredResource
  SecurityMetadata -> MAY_REFERENCE -> SecurityPolicy
  SecurityMetadata -> MAY_REFERENCE -> SecurityAuditEvent
  SecurityMetadata -> MAY_HAVE_PROVENANCE -> SecurityProvenance

# ---------- CLASSIFICATION ----------
entity SecurityClassification:
  type: ClassificationMetadata
  may_include:
    - classification_level
    - handling_requirements
    - authority
    - assigned_time
    - review_time

classification_levels:
  - public
  - internal
  - confidential
  - restricted
  - secret
  - implementation_specific

rule classification:
  classification level != access permission by itself

# ---------- IDENTITY / AUTHENTICATION ----------
entity IdentityMetadata:
  type: SecurityMetadata
  may_include:
    - principal_identifier
    - identity_provider
    - identity_type
    - account_state
    - verification_state

rule identity:
  claimed identity != verified identity

entity AuthenticationMetadata:
  type: SecurityMetadata
  may_include:
    - authentication_method
    - authentication_time
    - credential_type
    - identity_provider
    - assurance_level
    - result
    - session_identifier

authentication_methods:
  - password
  - passkey
  - certificate
  - hardware_token
  - one_time_password
  - biometric
  - federated_identity
  - multi_factor

rule authentication:
  authentication != authorisation

entity Credential:
  type: SecurityObject

rule secret:
  raw passwords, private keys, and secret tokens SHOULD NOT be exposed
  in general-purpose metadata

# ---------- AUTHORISATION / ACCESS ----------
entity AuthorisationMetadata:
  type: SecurityMetadata
  may_include:
    - principal
    - resource
    - action
    - decision
    - policy
    - decision_time
    - reason

authorisation_decisions:
  - allow
  - deny
  - conditional
  - indeterminate

rule authorisation:
  successful authentication != permission to perform requested action

entity Permission:
  type: AccessControlMetadata
  may_include:
    - action
    - resource
    - condition
    - scope
    - validity

entity SecurityRole:
  type: AccessControlMetadata
  may_include:
    - role_identifier
    - permissions
    - hierarchy
    - constraints

access_control_models:
  - discretionary_access_control
  - mandatory_access_control
  - role_based_access_control
  - attribute_based_access_control
  - capability_based_access_control
  - policy_based_access_control

rule access_control:
  policy definition != evidence that policy was enforced

# ---------- CIA ----------
entity ConfidentialityMetadata:
  type: SecurityMetadata
  may_include:
    - encryption_state
    - access_restrictions
    - data_classification
    - key_reference
    - transport_protection

entity SecurityIntegrityMetadata:
  type: SecurityMetadata
  may_include:
    - checksum
    - cryptographic_hash
    - digital_signature
    - integrity_state
    - verification_time

entity AvailabilityMetadata:
  type: SecurityMetadata
  may_include:
    - service_state
    - redundancy
    - backup_state
    - recovery_state
    - availability_target
    - measured_availability

rule confidentiality:
  confidentiality protects against unauthorised disclosure

rule integrity:
  integrity concerns unauthorised or unexpected modification

rule availability:
  availability target != measured availability

# ---------- CRYPTOGRAPHY ----------
entity CryptographicMetadata:
  type: SecurityMetadata
  may_include:
    - algorithm
    - key_identifier
    - key_length
    - mode
    - purpose
    - validity
    - cryptographic_state

rule algorithm:
  algorithm name alone != secure configuration

entity EncryptionMetadata:
  type: CryptographicMetadata

rule encryption:
  encryption != hashing
  encryption != digital_signature

entity SecurityHashMetadata:
  type: CryptographicMetadata

rule hash:
  hash does_not provide confidentiality

entity SecurityCertificateMetadata:
  type: SecurityMetadata
  may_include:
    - certificate_identifier
    - subject
    - issuer
    - serial_number
    - public_key
    - validity_start
    - validity_end
    - revocation_state
    - trust_chain

rule certificate:
  certificate subject name != independently verified identity
  without trust validation

# ---------- CONTROLS ----------
entity SecurityControl:
  type: ControlMetadata
  may_include:
    - control_identifier
    - control_type
    - objective
    - implementation_state
    - effectiveness_state
    - owner
    - evidence

control_types:
  - preventive
  - detective
  - corrective
  - deterrent
  - compensating
  - recovery

rule control:
  documented control != implemented control

rule effectiveness:
  implemented control != effective control
  without supporting evidence

# ---------- VULNERABILITY / THREAT / RISK ----------
entity Vulnerability:
  type: SecurityWeakness
  may_include:
    - vulnerability_identifier
    - affected_resource
    - description
    - severity
    - exploitability
    - discovery_time
    - remediation_state
    - provenance

rule vulnerability:
  vulnerability != active exploitation

entity Threat:
  type: SecurityRiskEntity
  may_include:
    - threat_identifier
    - threat_type
    - target
    - capability
    - intent
    - likelihood
    - evidence

rule threat:
  threat possibility != confirmed incident

entity SecurityRisk:
  type: RiskMetadata
  may_include:
    - asset
    - threat
    - vulnerability
    - likelihood
    - impact
    - risk_level
    - treatment
    - assessment_time

rule risk:
  assessed risk != observed incident

# ---------- INCIDENT / EVENT ----------
entity SecurityIncident:
  type: SecurityEvent
  may_include:
    - incident_identifier
    - incident_type
    - affected_resources
    - detection_time
    - start_time
    - end_time
    - severity
    - evidence
    - containment
    - remediation
    - status

incident_status:
  - suspected
  - confirmed
  - contained
  - eradicated
  - recovered
  - closed
  - unknown

rule incident:
  suspected incident != confirmed incident

entity SecurityEvent:
  type: EventMetadata
  may_include:
    - event_identifier
    - event_type
    - event_time
    - principal
    - resource
    - action
    - result
    - source
    - evidence

# ---------- AUDIT / POLICY / COMPLIANCE ----------
entity SecurityAuditEvent:
  type: SecurityEvent

rule audit:
  audit record SHOULD preserve provenance and tamper-evidence where required

rule absence:
  absence of audit record != proof that event did not occur

entity SecurityPolicy:
  type: PolicyMetadata
  may_include:
    - policy_identifier
    - policy_name
    - scope
    - requirements
    - controls
    - authority
    - effective_from
    - effective_until
    - version

rule policy:
  policy requirement != observed implementation state

entity SecurityComplianceMetadata:
  type: ComplianceMetadata
  may_include:
    - framework
    - requirement
    - evidence
    - assessment
    - status
    - assessment_time

rule compliance:
  compliance != complete security

# ---------- MONITORING / EVIDENCE ----------
entity SecurityAlert:
  type: SecurityEvent
  may_include:
    - alert_identifier
    - detection_rule
    - severity
    - evidence
    - status

rule alert:
  alert != confirmed security incident

entity SecurityEvidence:
  type: EvidenceMetadata
  may_include:
    - evidence_identifier
    - source
    - collection_time
    - collector
    - integrity
    - chain_of_custody
    - interpretation

rule evidence:
  evidence interpretation != raw evidence

# ---------- TEMPORAL / CONFIDENCE / PROVENANCE ----------
security_states:
  - secure_as_assessed
  - vulnerable
  - compromised
  - degraded
  - recovering
  - unknown

rule secure_state:
  secure_as_assessed != guaranteed secure

entity SecurityConfidence:
  type: EpistemicMetadata
  range: [0.0, 1.0]

rule confidence_bounds:
  REQUIRE 0.0 <= confidence <= 1.0

entity SecurityProvenance:
  type: ProvenanceMetadata
  may_include:
    - source
    - collector
    - tool
    - tool_version
    - observation_time
    - transformations
    - assessments
    - events

rule provenance:
  SecurityMetadata SHOULD preserve evidence and assessment provenance

# ---------- VALIDATION ----------
validation:
  require:
    - identifiable_security_subject_or_resource

  reject:
    - claimed_identity_presented_as verified_identity_without evidence
    - authentication_presented_as authorisation
    - policy_presented_as enforced_control_without evidence
    - implemented_control_presented_as effective_without evidence
    - vulnerability_presented_as active_exploitation_without evidence
    - threat_presented_as confirmed_incident
    - alert_presented_as confirmed_incident
    - compliance_presented_as complete_security
    - algorithm_name_presented_as secure_configuration
    - absence_of_audit_event_presented_as proof_of_non_occurrence

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE:
  "security metadata" ~= "metadata describing security state and controls"
  "authentication metadata" ~= "metadata describing identity authentication"
  "authorisation metadata" ~= "metadata describing access decisions and permissions"
  "security incident metadata" ~= "metadata describing security incidents"
  "security audit metadata" ~= "metadata describing auditable security events"
  "security risk metadata" ~= "metadata describing security risk assessments"

  PRESERVE distinctions:
    identity_claim != verified_identity
    authentication != authorisation
    classification != permission
    policy != enforcement
    control_documented != control_implemented
    control_implemented != control_effective
    vulnerability != exploitation
    threat != incident
    alert != confirmed_incident
    risk != incident
    compliance != complete_security
    integrity != authenticity
    encryption != hashing
    encryption != digital_signature
    absence_of_log != proof_of_non_occurrence

# ---------- CONFIDENCE MODEL ----------
CONFIDENCE:
  explicit_security_metadata:
    score: 1.00
  verified_identity_evidence:
    score: 0.99
  cryptographically_verified_integrity:
    score: 0.99
  confirmed_incident_with_evidence:
    score: 0.99
  validated_control_effectiveness:
    score: 0.98
  vulnerability_scan_finding:
    score: <= 0.90
  unverified_alert:
    score: <= 0.75
  inferred_threat:
    score: <= 0.70
  incomplete_security_provenance:
    score: <= 0.60
    action: preserve uncertainty

# ---------- UPDATE MODEL ----------
UPDATE_MODEL:
  on_security_observation:
    - identify resource and principal
    - record observation time
    - collect evidence
    - classify security metadata
    - assign confidence
    - initialise provenance

  on_authentication:
    - record principal
    - record authentication method
    - record result and assurance level
    - create security event
    - preserve provenance

  on_authorisation:
    - resolve authenticated principal
    - resolve requested resource and action
    - evaluate applicable policy
    - record decision and conditions
    - preserve audit evidence

  on_vulnerability_detection:
    - identify affected resource
    - record vulnerability and severity
    - preserve detection evidence
    - assess risk
    - update remediation state

  on_incident:
    - preserve detection evidence
    - classify incident status
    - identify affected resources
    - record containment and recovery
    - update provenance and confidence

# ---------- FLOW HASH ----------
FLOW_HASH:
  inputs:
    - ontology
    - security_entities
    - relationships
    - identity_rules
    - authentication_rules
    - authorisation_rules
    - control_rules
    - risk_rules
    - incident_rules
    - validation
    - semantic_equivalence
    - confidence_model
    - update_model

  canonicalisation:
    - preserve_resource_and_principal_identifiers
    - preserve_policy_versions
    - preserve_event_order
    - preserve_assessment_times
    - preserve_evidence_provenance
    - preserve_control_states
    - preserve_rule_order

  output:
    deterministic_semantic_hash

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION:
  interpret_as:
    - security metadata ontology
    - identity, authentication, authorisation, and access-control model
    - vulnerability, threat, risk, incident, and audit structure
    - cryptographic, compliance, evidence, and provenance model

  operations:
    - identify secured resources and principals
    - resolve classifications
    - distinguish authentication and authorisation
    - resolve roles and permissions
    - inspect confidentiality, integrity, and availability metadata
    - inspect cryptographic and certificate metadata
    - evaluate controls and implementation state
    - resolve vulnerabilities, threats, and risks
    - distinguish alerts from incidents
    - traverse audit events
    - evaluate policy and compliance evidence
    - trace provenance
    - preserve uncertainty

  constraints:
    - do_not_equate_identity_claim_with verified_identity
    - do_not_equate_authentication_with authorisation
    - do_not_equate_policy_with enforcement
    - do_not_equate_vulnerability_with exploitation
    - do_not_equate_alert_with confirmed_incident
    - do_not_equate_compliance_with complete_security
    - preserve_resources_principals_controls_events_evidence_and_provenance

# ---------- QUERY MODEL ----------
query:
  input:
    - security_identifier
    - resource_identifier
    - principal_identifier
    - classification
    - authentication_state
    - authorisation_state
    - vulnerability_identifier
    - threat_identifier
    - incident_identifier
    - assessment_time

  resolve:
    1. identify SecuredResource
    2. resolve SecurityPrincipal and identity evidence
    3. inspect authentication and authorisation
    4. resolve permissions, roles, controls, and policies
    5. inspect confidentiality, integrity, availability, and cryptography
    6. inspect vulnerabilities and threats
    7. assess risk and incident evidence
    8. traverse audit, monitoring, and compliance metadata
    9. inspect provenance and confidence
    10. return security state

  output:
    - secured_resource
    - principal
    - classification
    - authentication
    - authorisation
    - permissions
    - controls
    - vulnerabilities
    - threats
    - risk
    - incidents
    - audit
    - compliance
    - provenance
    - confidence

# ---------- INFERENCE ----------
inference:
  IF authentication succeeds
  THEN establish authenticated_principal_candidate
  BUT do_not infer authorisation

  IF vulnerability exists
  AND threat has capability to exploit it
  THEN increase risk candidate
  according_to likelihood and impact

  IF alert has corroborating evidence
  AND incident criteria are satisfied
  THEN promote incident status
  according_to policy

  IF evidence is incomplete or conflicting
  THEN preserve uncertainty
  AND reduce confidence

# ---------- OUTPUT CONTRACT ----------
output:
  ontology_entity: SecurityMetadata
  resource_identity: machine_interpretable
  principal_identity: evidence_aware
  authentication_authorisation: distinguishable
  classifications_roles_permissions: explicit
  CIA_metadata: explicit
  cryptographic_metadata: configuration_aware
  controls: implementation_and_effectiveness_distinct
  vulnerabilities_threats_risks: distinguishable
  incidents_alerts: evidence_aware
  audit_and_compliance: traceable
  policies: versioned
  provenance: preserved
  uncertainty: explicit
  security_reasoning: enabled

end flow