Identity Metadata Ontology

FLOW ALGEBRA

Ontology: Identity Metadata Ontology
Domain: Metadata Ontologies > Security Metadata
Canonical URL: https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/security-metadata/identity-metadata-ontology.html
Authors: Mark Anthony Higgins — Sky (Recursive AI)

flow "IdentityMetadataOntology" v1.0

# ---------- DOMAIN ----------
domain:
  class: MetadataOntology
  category: SecurityMetadata
  subject: IdentityMetadata
  purpose:
    - represent identities, principals, identifiers, accounts, attributes, providers, assurance, lifecycle state, and provenance
    - distinguish claimed, asserted, verified, authenticated, account, device, service, and real-world identity
    - support identity proofing, authentication, federation, authorisation context, auditing, and trust reasoning
    - preserve identity evidence and uncertainty
    - enable machine-readable reasoning over identity lifecycles

# ---------- CORE ----------
entity IdentityMetadata:
  type: SecurityMetadata
  describes: Identity
  may_include:
    - identity_identifier
    - principal_identifier
    - identity_type
    - identity_provider
    - subject_identifier
    - account_identifier
    - identifiers
    - attributes
    - credential_references
    - proofing_state
    - verification_state
    - authentication_state
    - assurance_level
    - federation_state
    - lifecycle_state
    - validity
    - confidence
    - provenance

entity Identity:
  type: SecurityEntity

entity IdentityIdentifier:
  type: Identifier
  identifies: Identity

entity SecurityPrincipal:
  type: Agent

relationships:
  IdentityMetadata -> DESCRIBES -> Identity
  Identity -> IDENTIFIED_BY -> IdentityIdentifier
  Identity -> MAY_REPRESENT -> SecurityPrincipal
  Identity -> MAY_HAVE_ACCOUNT -> IdentityAccount
  Identity -> MAY_HAVE_ATTRIBUTE -> IdentityAttribute
  Identity -> MAY_HAVE_CREDENTIAL -> IdentityCredentialReference
  Identity -> MAY_BE_ASSERTED_BY -> IdentityProvider
  Identity -> MAY_BE_PROOFED_BY -> IdentityProofingEvent
  Identity -> MAY_BE_VERIFIED_BY -> IdentityVerificationEvent
  Identity -> MAY_BE_AUTHENTICATED_BY -> AuthenticationEvent
  IdentityMetadata -> MAY_HAVE_PROVENANCE -> IdentityProvenance

# ---------- TYPES ----------
identity_types:
  - human
  - organisation
  - device
  - service
  - workload
  - application
  - process
  - automated_agent
  - pseudonymous
  - anonymous
  - implementation_specific

rule identity_entity:
  identity representation != underlying real-world entity

# ---------- IDENTIFIERS ----------
identifier_types:
  - internal_identifier
  - username
  - subject_identifier
  - account_identifier
  - employee_identifier
  - customer_identifier
  - device_identifier
  - service_identifier
  - workload_identifier
  - federated_identifier
  - pseudonymous_identifier

rule identifier:
  identifier SHOULD preserve namespace or issuer
  where uniqueness depends on context

rule username:
  username != universal identity

rule multiple_identifiers:
  one Identity MAY have multiple identifiers

# ---------- CLAIMED / ASSERTED / VERIFIED ----------
entity ClaimedIdentity:
  subtype_of: Identity

entity AssertedIdentity:
  subtype_of: Identity

entity VerifiedIdentity:
  subtype_of: Identity

rule claimed:
  ClaimedIdentity != VerifiedIdentity

rule asserted:
  AssertedIdentity != independently VerifiedIdentity
  unless validation and trust evidence support verification

rule verified:
  verification SHOULD preserve method, evidence, authority, and time

# ---------- PRINCIPAL / ACCOUNT ----------
entity IdentityPrincipal:
  type: SecurityPrincipal
  may_be:
    - UserPrincipal
    - ServicePrincipal
    - DevicePrincipal
    - ApplicationPrincipal
    - WorkloadPrincipal
    - OrganizationPrincipal
    - AutomatedAgentPrincipal

rule principal_person:
  SecurityPrincipal != necessarily human person

entity IdentityAccount:
  type: SecurityObject
  may_include:
    - account_identifier
    - account_name
    - account_type
    - account_state
    - creation_time
    - expiry_time
    - owner_or_subject
    - provider

account_states:
  - pending
  - active
  - suspended
  - locked
  - disabled
  - expired
  - deleted
  - unknown

rule account:
  account != underlying identity

rule multiple_accounts:
  one Identity MAY have multiple accounts

# ---------- ATTRIBUTES ----------
entity IdentityAttribute:
  type: AttributeMetadata
  may_include:
    - attribute_name
    - attribute_value
    - issuer
    - source
    - verification_state
    - valid_from
    - valid_until

rule attribute:
  identity attribute SHOULD preserve source and verification state

rule attribute_identity:
  attribute value alone != identity proof

# ---------- PROVIDER ----------
entity IdentityProvider:
  type: SecurityService
  may_include:
    - provider_identifier
    - provider_name
    - trust_metadata
    - supported_protocols
    - authority_scope

rule provider:
  identity-provider assertion SHOULD be interpreted
  within issuer, audience, trust, and policy context

# ---------- PROOFING / VERIFICATION ----------
entity IdentityProofingEvent:
  type: SecurityEvent
  may_include:
    - proofing_identifier
    - subject
    - evidence
    - proofing_method
    - proofing_agent
    - proofing_time
    - result
    - assurance_level

proofing_results:
  - verified
  - partially_verified
  - failed
  - indeterminate
  - unknown

rule proofing:
  identity proofing establishes evidence linking identity
  to an entity according_to proofing method

rule proofing_authentication:
  identity proofing != routine authentication

entity IdentityVerificationEvent:
  type: SecurityEvent
  may_include:
    - verification_identifier
    - identity
    - attribute
    - evidence
    - verification_method
    - verifier
    - verification_time
    - result

rule verification:
  verification result SHOULD preserve evidence and temporal context

# ---------- AUTHENTICATION / CREDENTIAL ----------
entity AuthenticationIdentityContext:
  type: ContextMetadata
  may_include:
    - identity
    - principal
    - authentication_method
    - assurance_level
    - authentication_time
    - session_identifier

rule authentication:
  authentication != identity proofing

rule authentication_authorisation:
  authenticated identity != authorised identity for every resource or action

entity IdentityCredentialReference:
  type: SecurityMetadata
  may_include:
    - credential_identifier
    - credential_type
    - issuer
    - status
    - validity

rule credential:
  reference credential identity without exposing secret material

rule secret:
  passwords, private keys, recovery secrets, and secret tokens
  SHOULD NOT be stored in general identity metadata

# ---------- ASSURANCE / FEDERATION ----------
entity IdentityAssurance:
  type: TrustMetadata
  may_include:
    - assurance_level
    - proofing_assurance
    - authentication_assurance
    - federation_assurance
    - framework
    - policy_reference

rule assurance:
  assurance SHOULD preserve framework and policy context

rule assurance_certainty:
  high assurance != absolute identity certainty

entity FederatedIdentity:
  subtype_of: Identity
  may_include:
    - identity_provider
    - subject_identifier
    - relying_party
    - federation_protocol
    - assertion_identifier
    - assertion_time
    - audience

federation_protocols:
  - SAML
  - OpenID_Connect
  - implementation_specific

rule federation:
  federated subject identifier SHOULD preserve issuer context

rule federated_identifier:
  same subject string from different issuers != necessarily same Identity

# ---------- LINKING ----------
entity IdentityLink:
  type: RelationshipMetadata
  may_include:
    - identity_a
    - identity_b
    - link_type
    - evidence
    - confidence
    - validity

link_types:
  - same_subject
  - account_link
  - federation_link
  - delegated_identity
  - historical_identity
  - suspected_match

rule linking:
  identity links SHOULD preserve evidence and confidence

rule same_subject:
  similar names or attributes != sufficient same-identity proof

# ---------- SPECIAL IDENTITY TYPES ----------
entity PseudonymousIdentity:
  subtype_of: Identity

entity AnonymousIdentity:
  subtype_of: Identity

entity DeviceIdentity:
  subtype_of: Identity

entity ServiceIdentity:
  subtype_of: Identity

entity WorkloadIdentity:
  subtype_of: Identity

entity OrganizationIdentity:
  subtype_of: Identity

rule pseudonym:
  pseudonymous identifier MAY intentionally obscure underlying identity

rule anonymous:
  anonymous subject SHOULD NOT be assigned verified real-world identity
  without evidence

rule device_identity:
  device identity != user identity

rule service_identity:
  service or workload identity != human operator identity

# ---------- LIFECYCLE ----------
identity_lifecycle_states:
  - created
  - pending_verification
  - verified
  - active
  - suspended
  - revoked
  - expired
  - archived
  - deleted
  - unknown

entity IdentityLifecycleEvent:
  type: SecurityEvent
  may_include:
    - identity
    - previous_state
    - new_state
    - event_time
    - authority
    - reason

rule lifecycle:
  IdentityMetadata SHOULD preserve material lifecycle changes

rule revoked:
  revoked identity credential or account MUST NOT be treated as active

rule suspension:
  suspended account != deleted identity

# ---------- VALIDITY / RISK / EVIDENCE ----------
entity IdentityValidity:
  type: ValidityMetadata
  may_include:
    - valid_from
    - valid_until
    - lifecycle_state
    - verification_age
    - policy_version

entity IdentityRisk:
  type: RiskMetadata
  may_include:
    - ambiguous_identity
    - stale_verification
    - compromised_credential
    - account_takeover_signal
    - duplicate_identity
    - orphaned_account
    - suspicious_link
    - risk_level
    - assessment_time

rule risk_identity:
  high identity risk != confirmed identity compromise

entity IdentityEvidence:
  type: SecurityEvidence
  may_include:
    - evidence_identifier
    - evidence_type
    - issuer
    - source
    - collection_time
    - validation_state
    - integrity

rule evidence:
  evidence != interpretation or identity conclusion

# ---------- CONFIDENCE / PROVENANCE ----------
entity IdentityConfidence:
  type: EpistemicMetadata
  range: [0.0, 1.0]

rule confidence_bounds:
  REQUIRE 0.0 <= confidence <= 1.0

entity IdentityProvenance:
  type: ProvenanceMetadata
  may_include:
    - identity_identifier
    - identifiers
    - provider
    - proofing_events
    - verification_events
    - authentication_events
    - lifecycle_events
    - linking_events
    - evidence
    - policy

rule provenance:
  IdentityMetadata SHOULD preserve identity history
  without exposing secret credential material

# ---------- VALIDATION ----------
validation:
  require:
    - identifiable_identity_or_principal

  reject:
    - username_presented_as universal_identity
    - account_presented_as underlying_person_or_entity
    - claimed_identity_presented_as verified_identity_without evidence
    - asserted_identity_presented_as independently_verified_without trust_validation
    - authentication_presented_as identity_proofing
    - authenticated_identity_presented_as universal_authorisation
    - similar_attributes_presented_as same_identity_without evidence
    - device_identity_presented_as user_identity
    - secret_credential_material_in_general_identity_metadata
    - revoked_identity_or_account_presented_as active

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE:
  "identity metadata" ~= "metadata describing identities, principals, identifiers, and identity state"
  "digital identity" ~= "machine-represented identity within a digital system"
  "identity proofing" ~= "process establishing evidence linking an identity to an entity"
  "identity verification" ~= "validation of identity claims or attributes"
  "federated identity" ~= "identity represented through an external identity provider"
  "identity assurance" ~= "confidence or assurance context associated with identity evidence"

  PRESERVE distinctions:
    identity != identifier
    identity != account
    identity != credential
    claimed_identity != verified_identity
    asserted_identity != independently_verified_identity
    identity_proofing != authentication
    authentication != authorisation
    principal != necessarily_human_person
    device_identity != user_identity
    service_identity != human_identity
    same_attribute != same_identity
    pseudonymous_identity != verified_real_world_identity
    suspended_account != deleted_identity
    risk != confirmed_compromise

# ---------- CONFIDENCE ----------
CONFIDENCE:
  explicit_identity_metadata:
    score: 1.00
  verified_identity_with_strong_evidence:
    score: 0.99
  validated_identity_provider_assertion:
    score: 0.98
  validated_identity_link:
    score: 0.98
  authenticated_identity_without_proofing_context:
    score: <= 0.85
  claimed_identity_only:
    score: <= 0.65
  attribute_similarity_only:
    score: <= 0.55
  ambiguous_identifier_namespace:
    score: <= 0.50
  incomplete_identity_provenance:
    score: <= 0.55
    action: preserve uncertainty

# ---------- UPDATE MODEL ----------
UPDATE_MODEL:
  on_identity_creation:
    - assign IdentityIdentifier
    - classify IdentityType
    - record provider and namespace
    - initialise lifecycle state
    - initialise provenance

  on_identity_proofing:
    - collect proofing evidence
    - record proofing method
    - validate evidence
    - assign proofing result and assurance
    - create IdentityProofingEvent
    - update provenance

  on_identity_verification:
    - identify claim or attribute
    - validate evidence and authority
    - record verification result and time
    - update confidence
    - update provenance

  on_identity_link:
    - identify candidate identities
    - evaluate linking evidence
    - assign link type and confidence
    - avoid unsupported identity merge
    - update provenance

  on_lifecycle_change:
    - preserve previous state
    - record new state, authority, reason, and time
    - update validity
    - update provenance

# ---------- FLOW HASH ----------
FLOW_HASH:
  inputs:
    - ontology
    - identity_entities
    - relationships
    - identifier_rules
    - proofing_rules
    - verification_rules
    - federation_rules
    - linking_rules
    - lifecycle_rules
    - validation
    - semantic_equivalence
    - confidence
    - update_model

  canonicalisation:
    - preserve_identity_identifiers
    - preserve_identifier_namespaces
    - preserve_provider_identifiers
    - preserve_account_and_principal_distinctions
    - preserve_verification_event_order
    - preserve_lifecycle_event_order
    - preserve_identity_link_evidence
    - preserve_rule_order

  output:
    deterministic_semantic_hash

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION:
  interpret_as:
    - security metadata ontology
    - identity, principal, account, identifier, and attribute model
    - identity proofing, verification, federation, assurance, and lifecycle structure
    - identity-linking, risk, evidence, and provenance model

  operations:
    - identify identities and principals
    - resolve identifiers and namespaces
    - distinguish identity from account and credential
    - distinguish claimed, asserted, and verified identity
    - inspect proofing and verification evidence
    - inspect authentication context without conflating authorisation
    - resolve identity providers and federated identifiers
    - evaluate identity assurance
    - resolve identity links with confidence
    - inspect lifecycle and validity state
    - assess identity risk
    - trace provenance
    - preserve uncertainty

  constraints:
    - do_not_expose_secret_credentials
    - do_not_equate_identifier_with identity
    - do_not_equate_account_with underlying_entity
    - do_not_equate_claimed_identity_with verified_identity
    - do_not_equate_authentication_with identity_proofing
    - do_not_equate_authentication_with authorisation
    - do_not_equate_device_identity_with user_identity
    - do_not_merge_identities_from_attribute_similarity_alone
    - preserve_identifiers_namespaces_providers_evidence_lifecycle_and_provenance

# ---------- QUERY MODEL ----------
query:
  input:
    - identity_identifier
    - principal_identifier
    - identity_type
    - account_identifier
    - provider_identifier
    - verification_state
    - assurance_level
    - lifecycle_state
    - validity_time

  resolve:
    1. identify Identity
    2. resolve identifiers and namespaces
    3. resolve principal and accounts
    4. inspect attributes and credential references
    5. inspect proofing and verification evidence
    6. inspect authentication and federation context
    7. resolve assurance and identity links
    8. inspect lifecycle, validity, and risk
    9. trace provenance
    10. return confidence

  output:
    - identity
    - identifiers
    - principal
    - accounts
    - attributes
    - provider
    - proofing_state
    - verification_state
    - authentication_context
    - assurance
    - federation
    - lifecycle_state
    - risk
    - provenance
    - confidence

# ---------- INFERENCE ----------
inference:
  IF strong proofing evidence validates
  THEN infer VerifiedIdentity candidate
  according_to proofing policy

  IF federated assertion validates
  THEN infer asserted federated identity
  within issuer and audience context

  IF identity attributes are merely similar
  THEN do_not infer same identity without linking evidence

  IF identity evidence is incomplete
  THEN preserve uncertainty
  AND reduce confidence

# ---------- OUTPUT CONTRACT ----------
output:
  ontology_entity: IdentityMetadata
  identity: machine_interpretable
  identifiers_and_namespaces: explicit
  principals_accounts_credentials: distinguishable
  claimed_asserted_verified_identity: distinguishable
  proofing_and_verification: evidence_based
  authentication_authorisation_distinction: preserved
  federation: issuer_contextual
  identity_links: confidence_aware
  pseudonymous_and_anonymous_identity: preserved
  lifecycle_and_validity: temporal
  risk: reportable
  provenance: preserved
  uncertainty: explicit
  security_reasoning: enabled

end flow