Authorisation Metadata Ontology

FLOW ALGEBRA

Ontology: Authorisation Metadata Ontology
Domain: Metadata Ontologies > Security Metadata
Canonical URL: https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/security-metadata/authorisation-metadata-ontology.html
Authors: Mark Anthony Higgins — Sky (Recursive AI)

flow "AuthorisationMetadataOntology" v1.0

# ---------- DOMAIN ----------
domain:
  class: MetadataOntology
  category: SecurityMetadata
  subject: AuthorisationMetadata
  purpose:
    - represent authorisation decisions, permissions, roles, policies, scopes, conditions, obligations, and enforcement
    - preserve principal, resource, requested action, policy context, decision, evidence, confidence, and provenance
    - support RBAC, ABAC, MAC, DAC, capability-based, and policy-based access control
    - distinguish authentication from authorisation and policy definition from enforcement
    - enable machine-readable reasoning over authorisation lifecycles

# ---------- CORE ----------
entity AuthorisationMetadata:
  type: SecurityMetadata
  describes: AuthorisationDecision
  may_include:
    - authorisation_identifier
    - principal
    - resource
    - requested_action
    - authentication_context
    - permission
    - role
    - attributes
    - policy
    - policy_version
    - conditions
    - obligations
    - decision
    - decision_reason
    - decision_time
    - enforcement_state
    - validity
    - confidence
    - provenance

entity AuthorisationDecision:
  type: SecurityDecisionMetadata

entity AuthorisationPrincipal:
  type: SecurityPrincipal

entity ProtectedResource:
  type: SecuredResource

relationships:
  AuthorisationMetadata -> DESCRIBES -> AuthorisationDecision
  AuthorisationDecision -> EVALUATES -> AuthorisationPrincipal
  AuthorisationDecision -> TARGETS -> ProtectedResource
  AuthorisationDecision -> EVALUATES_ACTION -> RequestedAction
  AuthorisationPrincipal -> MAY_HAVE -> Permission
  AuthorisationPrincipal -> MAY_HAVE_ROLE -> SecurityRole
  SecurityRole -> MAY_GRANT -> Permission
  Permission -> APPLIES_TO -> ProtectedResource
  AuthorisationDecision -> EVALUATED_BY -> PolicyDecisionPoint
  AuthorisationDecision -> MAY_BE_ENFORCED_BY -> PolicyEnforcementPoint
  AuthorisationDecision -> USES -> AuthorisationPolicy
  AuthorisationMetadata -> MAY_HAVE_PROVENANCE -> AuthorisationProvenance

# ---------- PRINCIPAL / RESOURCE / ACTION ----------
rule principal:
  AuthorisationPrincipal SHOULD have stable identifier

rule authenticated_principal:
  authenticated principal != authorised principal for every action

rule resource:
  authorisation SHOULD preserve exact target resource and scope

entity RequestedAction:
  type: ActionMetadata
  may_be:
    - read
    - write
    - create
    - update
    - delete
    - execute
    - administer
    - approve
    - share
    - export
    - impersonate
    - implementation_specific

rule action:
  Permission to one action != permission to another action

# ---------- DECISION ----------
authorisation_decisions:
  - allow
  - deny
  - conditional
  - not_applicable
  - indeterminate

rule decision:
  AuthorisationDecision SHOULD preserve decision, reason, time, and policy context

rule allow:
  allow applies only within evaluated resource, action, scope, conditions, and validity

rule deny:
  deny decision != authentication failure

# ---------- AUTHENTICATION CONTEXT ----------
entity AuthorisationAuthenticationContext:
  type: ContextMetadata
  may_include:
    - authentication_identifier
    - principal_identifier
    - authentication_method
    - assurance_level
    - authentication_time
    - session_identifier

rule authn_authz:
  authentication != authorisation

rule authentication_success:
  successful authentication MUST NOT automatically imply authorisation

# ---------- PERMISSION / ROLE ----------
entity Permission:
  type: AccessControlMetadata
  may_include:
    - permission_identifier
    - action
    - resource
    - scope
    - conditions
    - validity
    - source_policy

rule permission:
  Permission SHOULD preserve action, resource, scope, and conditions

rule permission_scope:
  permission outside declared scope MUST NOT be inferred

entity SecurityRole:
  type: AccessControlMetadata
  may_include:
    - role_identifier
    - role_name
    - permissions
    - parent_roles
    - child_roles
    - constraints
    - validity

rule role:
  role membership MAY grant permissions according_to policy

rule role_name:
  role label alone != permission

# ---------- AUTHORISATION MODELS ----------
authorisation_models:
  - RBAC
  - ABAC
  - MAC
  - DAC
  - capability_based
  - policy_based

entity RoleBasedAuthorisation:
  type: AuthorisationModel

entity AttributeBasedAuthorisation:
  type: AuthorisationModel
  may_include:
    - subject_attributes
    - resource_attributes
    - action_attributes
    - environment_attributes

rule RBAC:
  preserve principal-role and role-permission relationships

rule ABAC:
  preserve evaluated attributes and applicable policy

# ---------- POLICY ----------
entity AuthorisationPolicy:
  type: SecurityPolicy
  may_include:
    - policy_identifier
    - policy_version
    - scope
    - rules
    - combining_algorithm
    - authority
    - effective_from
    - effective_until

rule policy:
  policy definition != enforcement evidence

rule policy_version:
  AuthorisationDecision SHOULD preserve policy version

entity AuthorisationRule:
  type: PolicyRule
  may_include:
    - rule_identifier
    - target
    - condition
    - effect
    - priority

rule_effects:
  - permit
  - deny

# ---------- POLICY COMPONENTS ----------
entity PolicyDecisionPoint:
  type: SecurityComponent
  abbreviation: PDP

entity PolicyEnforcementPoint:
  type: SecurityComponent
  abbreviation: PEP

entity PolicyInformationPoint:
  type: SecurityComponent
  abbreviation: PIP

entity PolicyAdministrationPoint:
  type: SecurityComponent
  abbreviation: PAP

rule PDP:
  PolicyDecisionPoint evaluates applicable authorisation policy

rule PEP:
  decision generation != enforcement proof

# ---------- CONDITIONS / OBLIGATIONS / SCOPE ----------
entity AuthorisationCondition:
  type: ConstraintMetadata
  may_include:
    - condition_type
    - operator
    - expected_value
    - actual_value
    - result

condition_types:
  - time
  - location
  - device_state
  - network_state
  - authentication_assurance
  - resource_state
  - risk_level
  - business_rule

rule condition:
  conditional permission != unconditional permission

entity AuthorisationObligation:
  type: PolicyMetadata

entity AuthorisationAdvice:
  type: PolicyMetadata

rule advice:
  policy advice != mandatory obligation

entity AuthorisationScope:
  type: ScopeMetadata
  may_include:
    - resource_scope
    - action_scope
    - tenant_scope
    - project_scope
    - geographic_scope
    - temporal_scope

rule scope:
  authorisation MUST NOT silently expand beyond evaluated scope

# ---------- DELEGATION / IMPERSONATION ----------
entity DelegatedAuthorisation:
  type: AuthorisationMetadata
  may_include:
    - delegator
    - delegate
    - delegated_permissions
    - scope
    - validity
    - delegation_chain

rule delegation:
  delegated authority MUST NOT exceed delegator authority
  unless separate policy grants additional authority

entity ImpersonationAuthorisation:
  type: AuthorisationMetadata
  may_include:
    - actor
    - impersonated_principal
    - purpose
    - scope
    - approval
    - audit_event

rule impersonation:
  actor identity MUST remain distinguishable
  from impersonated principal identity

# ---------- VALIDITY / REVOCATION ----------
entity AuthorisationValidity:
  type: ValidityMetadata
  may_include:
    - valid_from
    - valid_until
    - session_validity
    - policy_validity
    - revocation_state

rule temporal:
  prior authorisation != current authorisation
  after validity or policy context changes

entity AuthorisationRevocation:
  type: SecurityEvent
  may_include:
    - permission
    - role
    - capability
    - principal
    - revocation_time
    - reason
    - authority

rule revocation:
  revoked permission MUST NOT be treated as currently valid

# ---------- GOVERNANCE ----------
entity LeastPrivilegeAssessment:
  type: SecurityAssessment
  may_include:
    - principal
    - required_permissions
    - granted_permissions
    - excess_permissions
    - assessment_time

rule least_privilege:
  granted permissions SHOULD be limited
  to permissions required for intended function

entity SeparationOfDutiesConstraint:
  type: AuthorisationConstraint
  may_include:
    - conflicting_roles
    - conflicting_permissions
    - workflow_stage
    - enforcement_state

rule SoD:
  conflicting duties SHOULD NOT be granted
  where policy requires separation

# ---------- RISK / EVIDENCE / AUDIT ----------
entity AuthorisationRisk:
  type: RiskMetadata
  may_include:
    - excessive_privilege
    - stale_role
    - orphaned_permission
    - policy_conflict
    - privilege_escalation
    - risky_context
    - risk_level
    - assessment_time

entity AuthorisationEvidence:
  type: SecurityEvidence
  may_include:
    - authentication_context
    - roles
    - permissions
    - attributes
    - policy
    - conditions
    - decision_trace
    - enforcement_evidence

entity AuthorisationAuditEvent:
  type: SecurityAuditEvent
  may_include:
    - authorisation_identifier
    - principal
    - resource
    - action
    - decision
    - policy
    - timestamp
    - enforcement_state

entity AuthorisationEnforcement:
  type: SecurityEvent
  may_include:
    - authorisation_decision
    - enforcement_point
    - enforced_action
    - result
    - timestamp

rule enforcement:
  authorisation decision != proof of enforcement

# ---------- CONFIDENCE / PROVENANCE ----------
entity AuthorisationConfidence:
  type: EpistemicMetadata
  range: [0.0, 1.0]

rule confidence_bounds:
  REQUIRE 0.0 <= confidence <= 1.0

entity AuthorisationProvenance:
  type: ProvenanceMetadata
  may_include:
    - principal
    - resource
    - action
    - authentication_context
    - roles
    - permissions
    - attributes
    - policy
    - policy_version
    - decision
    - enforcement
    - audit_events

rule provenance:
  AuthorisationMetadata SHOULD preserve decision
  and enforcement history

# ---------- VALIDATION ----------
validation:
  require:
    - identifiable_authorisation_decision
    - identifiable_principal
    - identifiable_resource
    - requested_action
    - authorisation_decision

  reject:
    - authentication_presented_as authorisation
    - authentication_success_presented_as universal_permission
    - role_name_presented_as permission_without policy
    - permission_applied_outside declared_scope
    - expired_or_revoked_permission_presented_as current
    - policy_definition_presented_as enforcement_evidence
    - decision_presented_as enforcement_without evidence
    - impersonated_identity_presented_as actor_identity
    - delegated_authority_exceeding_valid_delegator_scope_without separate_grant

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE:
  "authorisation metadata" ~= "metadata describing access-control decisions and permissions"
  "authorization metadata" ~= "authorisation metadata"
  "access decision" ~= "authorisation decision"
  "permission metadata" ~= "metadata describing allowed actions over resources"
  "role-based authorisation" ~= "RBAC-based access decision"
  "attribute-based authorisation" ~= "ABAC-based access decision"

  PRESERVE distinctions:
    authentication != authorisation
    authenticated_principal != universally_authorised_principal
    role != permission
    classification != permission
    policy != enforcement
    decision != enforcement
    conditional_permission != unconditional_permission
    advice != obligation
    delegated_principal != delegator
    actor != impersonated_principal
    expired_permission != current_permission
    risk != authorisation_denial
    privilege_increase != unauthorised_escalation

# ---------- CONFIDENCE ----------
CONFIDENCE:
  explicit_authorisation_metadata:
    score: 1.00
  explicit_policy_decision:
    score: 1.00
  verified_policy_and_enforcement:
    score: 0.99
  explicit_role_permission_mapping:
    score: 0.98
  validated_ABAC_attributes:
    score: 0.98
  inferred_permission_from_role_label_only:
    score: <= 0.60
  stale_policy_context:
    score: <= 0.65
  unknown_enforcement_state:
    score: <= 0.70
  incomplete_authorisation_provenance:
    score: <= 0.55
    action: preserve uncertainty

# ---------- UPDATE MODEL ----------
UPDATE_MODEL:
  on_authorisation_request:
    - identify principal
    - identify resource
    - identify requested action
    - resolve authentication context
    - resolve applicable policy
    - initialise provenance

  on_policy_evaluation:
    - resolve roles and permissions
    - resolve subject, resource, action, and environment attributes
    - evaluate conditions
    - evaluate policy rules
    - calculate AuthorisationDecision
    - record obligations and advice

  on_enforcement:
    - deliver decision to PolicyEnforcementPoint
    - enforce allow, deny, or conditional outcome
    - record enforcement result
    - create AuthorisationAuditEvent
    - update provenance

  on_revocation:
    - identify permission, role, or capability
    - record revocation authority and reason
    - invalidate affected current authority
    - create audit event
    - update provenance

# ---------- FLOW HASH ----------
FLOW_HASH:
  inputs:
    - ontology
    - authorisation_entities
    - relationships
    - principal_rules
    - permission_rules
    - role_rules
    - policy_rules
    - condition_rules
    - enforcement_rules
    - validation
    - semantic_equivalence
    - confidence
    - update_model

  canonicalisation:
    - preserve_authorisation_identifiers
    - preserve_principal_and_resource_identifiers
    - preserve_requested_actions
    - preserve_permission_scopes
    - preserve_policy_versions
    - preserve_decision_order
    - preserve_enforcement_evidence
    - preserve_rule_order

  output:
    deterministic_semantic_hash

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION:
  interpret_as:
    - security metadata ontology
    - authorisation and access-control decision model
    - roles, permissions, attributes, policies, conditions, and enforcement structure
    - delegation, revocation, audit, and provenance model

  operations:
    - identify authorisation decisions
    - resolve principals, resources, and requested actions
    - inspect authentication context without conflating it with authorisation
    - resolve roles and permissions
    - evaluate authorisation models
    - evaluate conditions, obligations, and scope
    - inspect delegation and impersonation
    - evaluate revocation and validity
    - inspect least privilege and separation of duties
    - distinguish decision from enforcement
    - traverse audit evidence
    - trace provenance
    - preserve uncertainty

  constraints:
    - do_not_equate_authentication_with authorisation
    - do_not_equate_role_label_with permission
    - do_not_expand_permission_beyond scope
    - do_not_equate_policy_with enforcement
    - do_not_equate_decision_with enforcement
    - do_not_treat_revoked_permission_as current
    - preserve_principals_resources_actions_policies_decisions_enforcement_and_provenance

# ---------- QUERY MODEL ----------
query:
  input:
    - authorisation_identifier
    - principal_identifier
    - resource_identifier
    - requested_action
    - role_identifier
    - permission_identifier
    - policy_identifier
    - decision
    - enforcement_state
    - assessment_time

  resolve:
    1. identify AuthorisationDecision
    2. resolve principal and authentication context
    3. resolve resource and requested action
    4. resolve roles, permissions, and attributes
    5. resolve applicable policy and version
    6. evaluate scope, conditions, obligations, and validity
    7. inspect decision and reason
    8. inspect enforcement and audit evidence
    9. inspect risk, confidence, and provenance
    10. return authorisation state

  output:
    - authorisation_decision
    - principal
    - resource
    - requested_action
    - authentication_context
    - roles
    - permissions
    - policy
    - conditions
    - obligations
    - decision
    - enforcement
    - validity
    - provenance
    - confidence

# ---------- INFERENCE ----------
inference:
  IF principal has valid Permission
  AND Permission covers requested resource and action
  AND conditions are satisfied
  THEN infer allow_candidate
  subject_to applicable policy

  IF authentication succeeds
  BUT no applicable permission exists
  THEN do_not infer allow

  IF permission is expired or revoked
  THEN infer not_currently_authorised
  for that permission scope

  IF decision exists
  BUT enforcement evidence is absent
  THEN preserve enforcement uncertainty

# ---------- OUTPUT CONTRACT ----------
output:
  ontology_entity: AuthorisationMetadata
  authorisation_identity: machine_interpretable
  principals_resources_actions: explicit
  authentication_authorisation_distinction: preserved
  roles_permissions_attributes: traceable
  authorisation_models: distinguishable
  policy_versions: preserved
  conditions_obligations_scope: explicit
  delegation_impersonation: identity_safe
  validity_revocation: temporal
  least_privilege_and_SoD: assessable
  decisions_and_enforcement: distinguishable
  audit: traversable
  provenance: preserved
  uncertainty: explicit
  security_reasoning: enabled

end flow