Compliance Metadata Ontology

FLOW ALGEBRA

Ontology: Compliance Metadata Ontology
Domain: Metadata Ontologies > Security Metadata
Canonical URL: https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/security-metadata/compliance-metadata-ontology.html
Authors: Mark Anthony Higgins — Sky (Recursive AI)

flow "ComplianceMetadataOntology" v1.0

# ---------- DOMAIN ----------
domain:
  class: MetadataOntology
  category: SecurityMetadata
  subject: ComplianceMetadata
  purpose:
    - represent compliance obligations, controls, evidence, assessments, findings, remediation, attestations, and status
    - preserve framework, requirement, scope, authority, assessment time, evidence, result, confidence, and provenance
    - support regulatory, contractual, policy, security, privacy, operational, and organisational compliance reasoning
    - distinguish compliance status from security, legality, certification, assurance, and complete risk reduction
    - enable machine-readable reasoning over compliance lifecycles

# ---------- CORE ----------
entity ComplianceMetadata:
  type: SecurityMetadata
  describes: ComplianceSubject
  may_include:
    - compliance_identifier
    - subject_identifier
    - framework
    - requirement
    - control
    - scope
    - jurisdiction
    - authority
    - responsible_party
    - evidence
    - assessment
    - finding
    - remediation
    - attestation
    - certification
    - status
    - validity
    - confidence
    - provenance

entity ComplianceSubject:
  type: ResourceOrOrganization

relationships:
  ComplianceMetadata -> DESCRIBES -> ComplianceSubject
  ComplianceMetadata -> REFERENCES -> ComplianceFramework
  ComplianceFramework -> CONTAINS -> ComplianceRequirement
  ComplianceRequirement -> MAY_MAP_TO -> ComplianceControl
  ComplianceAssessment -> EVALUATES -> ComplianceSubject
  ComplianceAssessment -> USES -> ComplianceEvidence
  ComplianceAssessment -> MAY_PRODUCE -> ComplianceFinding
  ComplianceFinding -> MAY_REQUIRE -> RemediationAction
  ComplianceMetadata -> MAY_HAVE_PROVENANCE -> ComplianceProvenance

# ---------- FRAMEWORK / REQUIREMENT ----------
entity ComplianceFramework:
  type: GovernanceMetadata
  may_include:
    - framework_identifier
    - framework_name
    - framework_version
    - publisher
    - jurisdiction
    - effective_from
    - effective_until

framework_types:
  - regulation
  - law
  - standard
  - contractual_requirement
  - internal_policy
  - industry_framework
  - certification_scheme

rule framework:
  ComplianceFramework SHOULD preserve version and authority

rule framework_version:
  compliance against one framework version != compliance against another version

entity ComplianceRequirement:
  type: GovernanceRequirement
  may_include:
    - requirement_identifier
    - requirement_text_reference
    - category
    - applicability
    - mandatory_state
    - effective_from
    - effective_until

rule applicability:
  non_applicable requirement != compliant requirement

# ---------- CONTROL / MAPPING / SCOPE ----------
entity ComplianceControl:
  type: ControlMetadata
  may_include:
    - control_identifier
    - control_name
    - objective
    - implementation_state
    - effectiveness_state
    - owner
    - evidence

rule control:
  documented control != implemented control

rule effectiveness:
  implemented control != effective control
  without supporting evidence

entity ComplianceMapping:
  type: RelationshipMetadata
  may_include:
    - source_requirement
    - target_requirement
    - control
    - mapping_type
    - confidence

mapping_types:
  - equivalent
  - partial
  - related
  - broader
  - narrower

rule mapping:
  mapped requirements MUST NOT imply exact equivalence without evidence

entity ComplianceScope:
  type: ScopeMetadata
  may_include:
    - organization
    - business_unit
    - system
    - service
    - application
    - dataset
    - location
    - process
    - time_period

rule scope:
  compliance status applies only to assessed scope

rule scope_expansion:
  compliance MUST NOT be inferred outside assessed scope

# ---------- EVIDENCE / ASSESSMENT ----------
entity ComplianceEvidence:
  type: EvidenceMetadata
  may_include:
    - evidence_identifier
    - evidence_type
    - source
    - collection_time
    - collector
    - integrity_state
    - validity
    - scope

rule evidence:
  evidence != compliance conclusion

rule evidence_age:
  stale evidence MAY reduce confidence in current compliance state

entity ComplianceAssessment:
  type: AssessmentMetadata
  may_include:
    - assessment_identifier
    - assessor
    - framework
    - framework_version
    - scope
    - requirements
    - evidence
    - methodology
    - assessment_time
    - result

assessment_types:
  - self_assessment
  - internal_audit
  - external_audit
  - automated_assessment
  - certification_assessment
  - regulatory_assessment

rule assessment:
  assessment SHOULD preserve method, assessor, scope, evidence, and time

# ---------- STATUS / FINDING ----------
compliance_status:
  - compliant
  - partially_compliant
  - non_compliant
  - not_applicable
  - not_assessed
  - pending
  - unknown

rule compliant:
  compliant status != permanent compliance

rule not_assessed:
  not_assessed != non_compliant

entity ComplianceFinding:
  type: AssessmentFinding
  may_include:
    - finding_identifier
    - requirement
    - control
    - evidence
    - severity
    - description
    - status
    - detected_time

# ---------- EXCEPTION / REMEDIATION / ASSURANCE ----------
entity ComplianceException:
  type: GovernanceMetadata
  may_include:
    - exception_identifier
    - requirement
    - rationale
    - approver
    - compensating_controls
    - valid_from
    - valid_until
    - status

rule exception:
  approved exception != compliance with original requirement

rule exception_expiry:
  expired exception MUST NOT be treated as current

entity RemediationAction:
  type: CorrectiveActionMetadata
  may_include:
    - remediation_identifier
    - finding
    - owner
    - action
    - due_date
    - completion_date
    - verification
    - status

rule remediation:
  remediation completion != verified remediation effectiveness
  without validation

entity ComplianceAttestation:
  type: AssuranceMetadata
  may_include:
    - attestation_identifier
    - attestor
    - subject
    - framework
    - scope
    - statement
    - attestation_time
    - validity

rule attestation:
  attestation != independent verification
  unless assessment context establishes it

entity ComplianceCertification:
  type: AssuranceMetadata
  may_include:
    - certification_identifier
    - certification_scheme
    - certifying_body
    - certified_subject
    - scope
    - issue_date
    - expiry_date
    - status

rule certification:
  certification applies only to certified scope and validity period

rule certification_security:
  certification != complete security or absence of risk

# ---------- AUTOMATION / CONTINUOUS COMPLIANCE ----------
entity AutomatedComplianceAssessment:
  subtype_of: ComplianceAssessment
  may_include:
    - tool
    - tool_version
    - rule_set
    - scan_time
    - coverage
    - limitations

rule automation:
  automated result != complete compliance assessment
  unless required scope and evidence are covered

entity ContinuousComplianceMetadata:
  type: MonitoringMetadata
  may_include:
    - monitored_controls
    - monitoring_frequency
    - last_check
    - current_state
    - alerts
    - evidence_stream

rule continuous:
  monitoring coverage SHOULD remain explicit

# ---------- SPECIALISATIONS ----------
entity PolicyCompliance:
  type: ComplianceMetadata

entity SecurityCompliance:
  type: ComplianceMetadata

entity PrivacyCompliance:
  type: ComplianceMetadata

entity ContractualCompliance:
  type: ComplianceMetadata

rule policy_compliance:
  internal-policy compliance != regulatory compliance
  unless mapped requirements establish relationship

rule security_compliance:
  security compliance != complete security

# ---------- RISK / VALIDITY / PROVENANCE ----------
entity ComplianceRisk:
  type: RiskMetadata
  may_include:
    - non_compliance_risk
    - control_failure_risk
    - evidence_gap
    - stale_assessment
    - expired_exception
    - remediation_delay
    - regulatory_change
    - impact
    - likelihood
    - risk_level
    - assessment_time

rule risk:
  compliance risk != confirmed non-compliance

entity ComplianceValidity:
  type: ValidityMetadata
  may_include:
    - valid_from
    - valid_until
    - framework_version
    - assessment_age
    - certification_state
    - exception_state

entity ComplianceConfidence:
  type: EpistemicMetadata
  range: [0.0, 1.0]

rule confidence_bounds:
  REQUIRE 0.0 <= confidence <= 1.0

entity ComplianceProvenance:
  type: ProvenanceMetadata
  may_include:
    - framework
    - framework_version
    - requirements
    - mappings
    - controls
    - assessments
    - evidence
    - findings
    - remediation
    - attestations
    - certifications
    - changes

rule provenance:
  ComplianceMetadata SHOULD preserve assessment and governance history

# ---------- VALIDATION ----------
validation:
  require:
    - identifiable_compliance_subject
    - identifiable_framework_or_requirement

  reject:
    - compliance_status_without framework_or_scope
    - not_assessed_presented_as non_compliant
    - mapped_requirements_presented_as exact_equivalence_without evidence
    - documented_control_presented_as implemented_control
    - implemented_control_presented_as effective_control_without evidence
    - attestation_presented_as independent_verification_without assessment
    - certification_presented_as complete_security
    - approved_exception_presented_as compliance_with_original_requirement
    - expired_exception_presented_as current
    - remediation_completion_presented_as verified_effectiveness_without evidence
    - policy_compliance_presented_as regulatory_compliance_without mapping

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE:
  "compliance metadata" ~= "metadata describing obligations, assessments, evidence, and compliance status"
  "compliance assessment" ~= "evaluation of subject against applicable requirements"
  "compliance evidence" ~= "evidence used to support compliance assessment"
  "compliance finding" ~= "assessment finding relating to a requirement or control"
  "remediation metadata" ~= "metadata describing corrective action for compliance findings"
  "continuous compliance" ~= "ongoing monitoring of compliance-relevant controls and evidence"

  PRESERVE distinctions:
    compliance != security
    compliance != legality
    compliance != absence_of_risk
    requirement != control
    documented_control != implemented_control
    implemented_control != effective_control
    evidence != compliance_conclusion
    not_assessed != non_compliant
    exception != compliance_with_original_requirement
    attestation != independent_verification
    certification != complete_security
    remediation_completed != remediation_verified
    scoped_compliance != universal_compliance

# ---------- CONFIDENCE ----------
CONFIDENCE:
  explicit_compliance_metadata:
    score: 1.00
  independently_verified_assessment:
    score: 0.99
  current_valid_certification:
    score: 0.98
  complete_evidence_for_requirement:
    score: 0.98
  automated_check_with_known_coverage:
    score: <= 0.90
  self_attestation_only:
    score: <= 0.75
  stale_assessment:
    score: <= 0.70
  incomplete_evidence:
    score: <= 0.60
  unknown_scope_or_framework_version:
    score: <= 0.50
    action: preserve uncertainty

# ---------- UPDATE MODEL ----------
UPDATE_MODEL:
  on_framework_registration:
    - assign framework identifier and version
    - record publisher and authority
    - ingest requirements
    - initialise provenance

  on_assessment:
    - identify ComplianceSubject
    - resolve framework, version, requirements, and scope
    - collect ComplianceEvidence
    - evaluate controls
    - record ComplianceAssessment
    - create findings
    - calculate status and confidence
    - update provenance

  on_finding:
    - identify affected requirement and control
    - preserve evidence
    - classify finding
    - assign remediation owner
    - create RemediationAction
    - update provenance

  on_remediation:
    - preserve remediation action
    - record completion evidence
    - verify effectiveness where required
    - update finding and compliance status
    - update provenance

# ---------- FLOW HASH ----------
FLOW_HASH:
  inputs:
    - ontology
    - compliance_entities
    - relationships
    - framework_rules
    - requirement_rules
    - control_rules
    - evidence_rules
    - assessment_rules
    - remediation_rules
    - validation
    - semantic_equivalence
    - confidence
    - update_model

  canonicalisation:
    - preserve_compliance_identifiers
    - preserve_framework_identifiers_and_versions
    - preserve_requirement_identifiers
    - preserve_scope
    - preserve_evidence_provenance
    - preserve_assessment_order
    - preserve_findings_and_remediation_history
    - preserve_rule_order

  output:
    deterministic_semantic_hash

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION:
  interpret_as:
    - security metadata ontology
    - compliance framework, requirement, control, and assessment model
    - evidence, finding, remediation, attestation, and certification structure
    - continuous compliance and governance provenance model

  operations:
    - identify compliance subjects
    - resolve frameworks and versions
    - resolve applicable requirements
    - map requirements to controls
    - inspect scope and jurisdiction
    - evaluate evidence
    - inspect assessments and findings
    - track remediation
    - inspect attestations and certifications
    - evaluate exceptions and validity
    - monitor continuous compliance
    - assess compliance risk
    - trace provenance
    - preserve uncertainty

  constraints:
    - do_not_equate_compliance_with security
    - do_not_equate_compliance_with legality
    - do_not_equate_compliance_with absence_of_risk
    - do_not_equate_documented_control_with implemented_control
    - do_not_equate_attestation_with independent_verification
    - do_not_equate_certification_with complete_security
    - do_not_expand_compliance_beyond assessed_scope
    - preserve_framework_versions_requirements_evidence_assessments_findings_and_provenance

# ---------- QUERY MODEL ----------
query:
  input:
    - compliance_identifier
    - subject_identifier
    - framework_identifier
    - framework_version
    - requirement_identifier
    - control_identifier
    - assessment_identifier
    - compliance_status
    - certification_identifier
    - assessment_time

  resolve:
    1. identify ComplianceSubject
    2. resolve ComplianceFramework and version
    3. resolve applicable requirements and scope
    4. resolve mapped controls
    5. inspect ComplianceEvidence
    6. inspect assessment methodology and findings
    7. inspect remediation, exceptions, attestations, and certifications
    8. evaluate status, validity, and risk
    9. trace provenance and confidence
    10. return compliance state

  output:
    - compliance_subject
    - framework
    - framework_version
    - requirements
    - controls
    - scope
    - evidence
    - assessments
    - findings
    - remediation
    - exceptions
    - attestations
    - certifications
    - status
    - provenance
    - confidence

# ---------- INFERENCE ----------
inference:
  IF applicable requirement is satisfied
  AND current evidence supports implemented and effective controls
  THEN infer compliant_candidate
  within assessed scope and time

  IF requirement has not been assessed
  THEN infer not_assessed
  AND do_not infer non_compliant

  IF certification is current
  THEN infer certified_state
  only within certified scope
  AND do_not infer complete security

  IF evidence is stale or incomplete
  THEN preserve compliance uncertainty
  AND reduce confidence

# ---------- OUTPUT CONTRACT ----------
output:
  ontology_entity: ComplianceMetadata
  compliance_subject: machine_interpretable
  frameworks_and_versions: explicit
  requirements_and_controls: distinguishable
  scope_and_jurisdiction: explicit
  evidence: provenance_preserved
  assessments_and_findings: traceable
  remediation: verification_aware
  exceptions: validity_aware
  attestations_and_certifications: scope_aware
  compliance_security_legality_distinctions: preserved
  risk: reportable
  provenance: preserved
  uncertainty: explicit
  compliance_reasoning: enabled

end flow