Authentication Metadata Ontology
Security Metadata
Authors: MArk Anthony Higgins - Sky Recursive Ai
Revised Date: 08 October 2026
Audio Overview
FLOW ALGEBRA
Ontology: Authentication Metadata Ontology
Domain: Metadata Ontologies > Security Metadata
Canonical URL: https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/security-metadata/authentication-metadata-ontology.html
Authors: Mark Anthony Higgins — Sky (Recursive AI)
flow "AuthenticationMetadataOntology" v1.0
# ---------- DOMAIN ----------
domain:
class: MetadataOntology
category: SecurityMetadata
subject: AuthenticationMetadata
purpose:
- represent authentication processes, identities, credentials, factors, sessions, assurance, outcomes, and evidence
- preserve principal identity, method, factors, provider, timestamps, result, confidence, and provenance
- support password, passkey, certificate, token, biometric, federated, multi-factor, and machine authentication
- distinguish authentication from identity proofing, authorisation, session state, and access permission
- enable machine-readable reasoning over authentication lifecycles
# ---------- CORE ----------
entity AuthenticationMetadata:
type: SecurityMetadata
describes: AuthenticationEvent
may_include:
- authentication_identifier
- principal_identifier
- claimed_identity
- verified_identity
- authentication_method
- authentication_factors
- credential
- identity_provider
- relying_party
- assurance_level
- authentication_time
- result
- failure_reason
- session_identifier
- device_context
- network_context
- risk_context
- confidence
- provenance
entity AuthenticationEvent:
type: SecurityEvent
entity AuthenticationIdentifier:
type: Identifier
identifies: AuthenticationEvent
entity AuthenticationPrincipal:
type: SecurityPrincipal
relationships:
AuthenticationMetadata -> DESCRIBES -> AuthenticationEvent
AuthenticationEvent -> IDENTIFIED_BY -> AuthenticationIdentifier
AuthenticationEvent -> AUTHENTICATES -> AuthenticationPrincipal
AuthenticationPrincipal -> PRESENTS -> Credential
AuthenticationEvent -> USES_METHOD -> AuthenticationMethod
AuthenticationEvent -> MAY_USE_FACTOR -> AuthenticationFactor
AuthenticationEvent -> MAY_USE_PROVIDER -> IdentityProvider
AuthenticationEvent -> TARGETS -> RelyingParty
AuthenticationEvent -> PRODUCES -> AuthenticationResult
AuthenticationEvent -> MAY_ESTABLISH -> AuthenticatedSession
AuthenticationMetadata -> MAY_REFERENCE -> AuthenticationEvidence
AuthenticationMetadata -> MAY_HAVE_PROVENANCE -> AuthenticationProvenance
# ---------- IDENTITY ----------
entity ClaimedIdentity:
type: IdentityMetadata
entity VerifiedIdentity:
type: IdentityMetadata
rule identity_claim:
ClaimedIdentity != VerifiedIdentity
rule authentication_identity:
successful authentication supports an identity claim
according_to method and assurance
but != universal proof of real-world identity
rule username:
username != universal person identity
# ---------- METHODS ----------
authentication_methods:
- password
- passkey
- public_key
- digital_certificate
- hardware_token
- one_time_password
- biometric
- smart_card
- federated_identity
- API_key
- bearer_token
- mutual_TLS
- multi_factor
- implementation_specific
entity AuthenticationMethod:
type: SecurityMethodMetadata
rule method:
AuthenticationMethod SHOULD be explicit
# ---------- FACTORS ----------
authentication_factor_types:
- knowledge
- possession
- inherence
- location
- behaviour
- contextual
entity AuthenticationFactor:
type: SecurityEvidence
may_include:
- factor_type
- factor_identifier
- verification_method
- result
rule factor:
multiple credentials of same factor type
MAY NOT constitute independent multi-factor authentication
# ---------- CREDENTIALS ----------
entity Credential:
type: SecurityObject
may_include:
- credential_identifier
- credential_type
- issuer
- issued_time
- valid_from
- valid_until
- status
credential_status:
- active
- expired
- revoked
- suspended
- compromised
- unknown
rule credential:
secret credential material SHOULD NOT be exposed
in general metadata
rule password_secret:
plaintext password MUST NOT be stored
in authentication metadata
rule private_key:
private authentication key SHOULD NOT be exposed
in general metadata
rule OTP_secret:
OTP secret SHOULD NOT be exposed
in general metadata
# ---------- METHOD SPECIALISATIONS ----------
entity PasswordAuthentication:
subtype_of: AuthenticationMethod
entity PasskeyAuthentication:
subtype_of: AuthenticationMethod
may_include:
- credential_identifier
- public_key_reference
- authenticator
- user_verification_state
entity CertificateAuthentication:
subtype_of: AuthenticationMethod
may_include:
- certificate_identifier
- subject
- issuer
- validity
- revocation_state
- trust_chain
rule certificate:
certificate presentation != trusted identity
without certificate and trust validation
entity OneTimePasswordAuthentication:
subtype_of: AuthenticationMethod
may_include:
- OTP_type
- issuer
- verification_time
- result
entity BiometricAuthentication:
subtype_of: AuthenticationMethod
may_include:
- biometric_type
- matcher
- confidence
- liveness_state
- result
rule biometric:
biometric match != absolute identity certainty
# ---------- FEDERATION ----------
entity FederatedAuthentication:
subtype_of: AuthenticationMethod
may_include:
- identity_provider
- relying_party
- federation_protocol
- assertion_identifier
- assertion_time
- audience
- result
federation_protocols:
- SAML
- OpenID_Connect
- OAuth_related_identity_flow
- implementation_specific
rule federation:
federated assertion SHOULD preserve issuer, audience, time, and validation context
# ---------- MULTI-FACTOR ----------
entity MultiFactorAuthentication:
subtype_of: AuthenticationMethod
may_include:
- factors
- factor_count
- independent_factor_types
- result
rule MFA:
MultiFactorAuthentication SHOULD use multiple independent factor categories
rule MFA_success:
MFA success != authorisation
# ---------- MACHINE AUTHENTICATION ----------
entity MachineAuthentication:
subtype_of: AuthenticationMethod
may_include:
- service_identity
- workload_identity
- certificate
- token
- key_reference
rule machine:
machine principal SHOULD remain distinguishable
from human principal
# ---------- PROVIDER / RELYING PARTY ----------
entity IdentityProvider:
type: SecurityService
entity RelyingParty:
type: SecurityEntity
rule relying_party:
authentication acceptance depends on relying-party policy
# ---------- RESULT / FAILURE ----------
entity AuthenticationResult:
type: SecurityDecisionMetadata
may_be:
- successful
- failed
- challenged
- denied
- expired
- locked
- cancelled
- indeterminate
- unknown
rule result:
AuthenticationResult SHOULD preserve method, time, and principal context
entity AuthenticationFailure:
type: SecurityEvent
may_include:
- failure_reason
- method
- principal
- time
- risk_signal
failure_reasons:
- invalid_credential
- expired_credential
- revoked_credential
- locked_account
- failed_factor
- invalid_certificate
- invalid_assertion
- replay_detected
- timeout
- policy_rejection
- unknown
rule failure:
failed authentication != malicious activity by itself
# ---------- ASSURANCE ----------
entity AuthenticationAssurance:
type: TrustMetadata
may_include:
- assurance_level
- proofing_strength
- authenticator_strength
- federation_assurance
- policy_reference
rule assurance:
assurance level SHOULD preserve framework or policy context
rule assurance_identity:
high authentication assurance != complete real-world identity proof
# ---------- SESSION ----------
entity AuthenticatedSession:
type: SecuritySession
may_include:
- session_identifier
- principal
- authentication_time
- assurance_level
- expiry_time
- reauthentication_requirement
- status
rule session:
authenticated session != permanent authentication state
rule session_authz:
authenticated session != authorisation for every resource
entity ReauthenticationEvent:
subtype_of: AuthenticationEvent
may_include:
- prior_session
- trigger
- method
- result
# ---------- CONTEXT / RISK ----------
entity AuthenticationDeviceContext:
type: ContextMetadata
may_include:
- device_identifier
- device_type
- managed_state
- trust_state
- platform
- security_posture
rule device:
trusted device context != verified user identity
entity AuthenticationNetworkContext:
type: ContextMetadata
may_include:
- network_identifier
- address_metadata
- network_type
- risk_state
rule network:
network location != identity proof
entity AuthenticationRisk:
type: RiskMetadata
may_include:
- principal_risk
- device_risk
- network_risk
- behavioural_risk
- anomaly_score
- risk_level
- assessment_time
rule risk:
authentication risk score SHOULD preserve model, evidence, and assessment time
rule risk_result:
high risk != confirmed compromise
# ---------- EVIDENCE / AUDIT ----------
entity AuthenticationEvidence:
type: SecurityEvidence
may_include:
- credential_validation
- factor_validation
- certificate_validation
- assertion_validation
- device_context
- risk_context
- timestamp
rule evidence:
AuthenticationEvidence SHOULD preserve source and validation method
entity AuthenticationAuditEvent:
type: SecurityAuditEvent
may_include:
- authentication_identifier
- principal_identifier
- method
- result
- timestamp
- source
- session_identifier
rule audit:
authentication audit SHOULD avoid exposing secret credential material
# ---------- KEY DISTINCTIONS ----------
rule authn_authz:
authentication answers identity evidence question
authorisation answers permission question
rule success_permission:
successful authentication MUST NOT imply access permission automatically
entity IdentityProofingMetadata:
type: IdentityMetadata
rule proofing:
identity proofing != routine authentication
# ---------- VALIDITY / CONFIDENCE ----------
entity AuthenticationValidity:
type: ValidityMetadata
may_include:
- valid_from
- valid_until
- credential_status
- session_status
- policy_version
entity AuthenticationConfidence:
type: EpistemicMetadata
range: [0.0, 1.0]
rule confidence_bounds:
REQUIRE 0.0 <= confidence <= 1.0
rule confidence:
confidence SHOULD qualify identity or authentication inference
and NOT authorisation
# ---------- PROVENANCE ----------
entity AuthenticationProvenance:
type: ProvenanceMetadata
may_include:
- principal
- identity_provider
- relying_party
- method
- factors
- credential_identifier
- authentication_events
- assurance
- policy
- audit_source
rule provenance:
AuthenticationMetadata SHOULD preserve authentication history
without exposing secret material
# ---------- VALIDATION ----------
validation:
require:
- identifiable_authentication_event
- authentication_method
- authentication_result
reject:
- plaintext_password_in_metadata
- private_key_in_general_metadata
- OTP_secret_in_metadata
- claimed_identity_presented_as verified_identity_without evidence
- certificate_presented_as trusted_identity_without validation
- authentication_presented_as authorisation
- successful_authentication_presented_as universal_access_permission
- multiple_same_type_credentials_presented_as independent_MFA_without evidence
- high_risk_score_presented_as confirmed_compromise
# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE:
"authentication metadata" ~= "metadata describing authentication events and evidence"
"user authentication" ~= "verification of a user identity claim"
"machine authentication" ~= "verification of a machine or workload identity claim"
"multi-factor authentication" ~= "authentication using multiple independent factor categories"
"federated authentication" ~= "authentication relying on identity-provider assertions"
"authentication assurance" ~= "strength or confidence context of authentication"
PRESERVE distinctions:
claimed_identity != verified_identity
authentication != identification
authentication != identity_proofing
authentication != authorisation
authentication_success != access_permission
credential_identifier != secret_credential_value
certificate_presentation != trusted_identity
session != permanent_authentication
trusted_device != verified_user_identity
network_location != identity_proof
authentication_risk != confirmed_compromise
MFA != multiple_credentials_of_same_factor_type
# ---------- CONFIDENCE MODEL ----------
CONFIDENCE:
explicit_authentication_metadata:
score: 1.00
cryptographically_verified_authentication:
score: 0.99
validated_multi_factor_authentication:
score: 0.99
validated_federated_assertion:
score: 0.98
valid_certificate_authentication:
score: 0.98
password_only_success:
score: <= 0.90
claimed_identity_without_strong_verification:
score: <= 0.70
ambiguous_principal:
score: <= 0.60
incomplete_authentication_provenance:
score: <= 0.55
action: preserve uncertainty
# ---------- UPDATE MODEL ----------
UPDATE_MODEL:
on_authentication_start:
- assign AuthenticationIdentifier
- identify claimed principal
- identify relying party
- record authentication method
- initialise provenance
on_factor_validation:
- validate presented factor
- record factor type
- preserve result without secret value
- update assurance
- update provenance
on_authentication_success:
- record successful AuthenticationResult
- calculate assurance
- establish AuthenticatedSession where applicable
- create AuthenticationAuditEvent
- preserve authorisation distinction
on_authentication_failure:
- record failure reason
- update retry or lockout state
- assess risk signals
- create AuthenticationAuditEvent
- preserve uncertainty about malicious intent
# ---------- FLOW HASH ----------
FLOW_HASH:
inputs:
- ontology
- authentication_entities
- relationships
- identity_rules
- method_rules
- factor_rules
- credential_rules
- assurance_rules
- session_rules
- validation
- semantic_equivalence
- confidence_model
- update_model
canonicalisation:
- preserve_authentication_identifiers
- preserve_principal_identifiers
- preserve_credential_identifiers_without_secrets
- preserve_factor_types
- preserve_event_order
- preserve_assurance_context
- preserve_policy_versions
- preserve_rule_order
output:
deterministic_semantic_hash
# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION:
interpret_as:
- security metadata ontology
- authentication event and identity-evidence model
- credential, factor, assurance, session, and federation structure
- authentication risk and audit model
operations:
- identify authentication events
- resolve principals and claimed identities
- resolve authentication methods
- inspect credentials without exposing secrets
- classify authentication factors
- validate MFA structure
- inspect certificate and federated authentication
- evaluate assurance
- resolve authenticated sessions
- inspect device, network, and risk context
- traverse authentication audit events
- trace provenance
- preserve uncertainty
constraints:
- do_not_expose_secret_credentials
- do_not_equate_claimed_identity_with_verified_identity
- do_not_equate_authentication_with_authorisation
- do_not_equate_authentication_success_with_universal_access
- do_not_equate_certificate_presentation_with_trusted_identity
- do_not_equate_risk_score_with_confirmed_compromise
- preserve_principals_methods_factors_assurance_sessions_events_and_provenance
# ---------- QUERY MODEL ----------
query:
input:
- authentication_identifier
- principal_identifier
- authentication_method
- credential_identifier
- identity_provider
- assurance_level
- session_identifier
- authentication_result
- authentication_time
- risk_level
resolve:
1. identify AuthenticationEvent
2. resolve principal and identity claim
3. resolve authentication method and factors
4. inspect credential status without secret value
5. inspect identity-provider and relying-party context
6. calculate or inspect authentication assurance
7. inspect result, failure reason, and risk context
8. resolve authenticated session and validity
9. traverse audit evidence and provenance
10. return confidence
output:
- authentication_event
- authentication_identifier
- principal
- claimed_identity
- verified_identity_candidate
- method
- factors
- credential_metadata
- identity_provider
- relying_party
- assurance
- result
- session
- risk
- provenance
- confidence
# ---------- INFERENCE ----------
inference:
IF authentication factors validate
AND applicable policy requirements are satisfied
THEN infer authentication_success_candidate
WITH assurance according_to method and factors
IF multiple independent factor categories validate
THEN infer MultiFactorAuthentication
subject_to factor independence
IF authentication succeeds
THEN MAY establish AuthenticatedSession
BUT MUST NOT infer resource authorisation automatically
IF authentication evidence is incomplete or ambiguous
THEN preserve identity uncertainty
AND reduce confidence
# ---------- OUTPUT CONTRACT ----------
output:
ontology_entity: AuthenticationMetadata
authentication_identity: machine_interpretable
principals: identifier_grounded
claimed_and_verified_identity: distinguishable
methods_and_factors: explicit
credentials: secret_safe
MFA: factor_independence_aware
federation: issuer_and_audience_aware
assurance: policy_contextual
sessions: temporal
authentication_authorisation_distinction: preserved
device_network_risk_context: explicit
audit_events: traversable
provenance: preserved
uncertainty: explicit
security_reasoning: enabled
end flow