Security Metadata Ontology

FLOW ALGEBRA

Ontology: Security Metadata Ontology
Domain: Metadata Ontologies > Security Metadata
Canonical URL: https://kirethresearch.org/booksai-core/ontologies/metadata-ontologies/security-metadata/security-metadata-ontology.html
Authors: Mark Anthony Higgins — Sky (Recursive AI)

flow "SecurityMetadataOntology" v1.0

# ---------- DOMAIN ----------
domain:
  class: MetadataOntology
  category: SecurityMetadata
  subject: SecurityMetadata
  purpose:
    - represent metadata describing security state and protection requirements of digital resources
    - preserve identity, authentication, authorisation, access control, confidentiality, integrity, availability, threats, vulnerabilities, incidents, audit evidence, and provenance
    - support security monitoring, access decisions, risk assessment, incident response, compliance, forensics, and AI-assisted security reasoning
    - distinguish asserted security properties from observed, validated, and enforced security state
    - enable machine-readable reasoning over security metadata lifecycles

# ---------- CORE ----------
entity SecurityMetadata:
  type: MetadataEntity
  describes: SecuredResource
  may_include:
    - security_metadata_identifier
    - resource_identifier
    - classification
    - identity
    - authentication
    - authorisation
    - permissions
    - access_control
    - confidentiality
    - integrity
    - availability
    - cryptography
    - certificate
    - vulnerability
    - threat
    - risk
    - incident
    - audit
    - policy
    - compliance
    - evidence
    - validity
    - confidence
    - provenance

entity SecuredResource:
  type: Resource

entity SecurityMetadataIdentifier:
  type: Identifier
  identifies: SecurityMetadata

relationships:
  SecurityMetadata -> DESCRIBES -> SecuredResource
  SecurityMetadata -> IDENTIFIED_BY -> SecurityMetadataIdentifier
  SecuredResource -> MAY_HAVE_CLASSIFICATION -> SecurityClassification
  SecuredResource -> MAY_BE_PROTECTED_BY -> SecurityControl
  SecuredResource -> MAY_HAVE_VULNERABILITY -> Vulnerability
  SecurityPrincipal -> MAY_AUTHENTICATE_WITH -> Credential
  SecurityPrincipal -> MAY_HAVE_ROLE -> SecurityRole
  SecurityPrincipal -> MAY_HAVE_PERMISSION -> Permission
  Permission -> APPLIES_TO -> SecuredResource
  Threat -> MAY_EXPLOIT -> Vulnerability
  SecurityIncident -> MAY_AFFECT -> SecuredResource
  SecurityMetadata -> MAY_REFERENCE -> SecurityPolicy
  SecurityMetadata -> MAY_REFERENCE -> SecurityAuditEvent
  SecurityMetadata -> MAY_REFERENCE -> SecurityEvidence
  SecurityMetadata -> MAY_HAVE_PROVENANCE -> SecurityMetadataProvenance

# ---------- IDENTITY / CLASSIFICATION ----------
entity SecurityPrincipal:
  type: Agent
  may_be:
    - User
    - ServiceAccount
    - Application
    - Device
    - Organization
    - AutomatedAgent

rule identity_claim:
  claimed identity != verified identity

rule username:
  username != universal person identity

entity SecurityClassification:
  type: ClassificationMetadata
  may_include:
    - classification_level
    - handling_requirements
    - authority
    - assigned_time
    - review_time

classification_levels:
  - public
  - internal
  - confidential
  - restricted
  - secret
  - implementation_specific

rule classification:
  classification level != access permission


# ---------- AUTHENTICATION / AUTHORISATION ----------
entity AuthenticationSecurityMetadata:
  type: SecurityMetadata
  may_include:
    - principal
    - authentication_method
    - credential_type
    - identity_provider
    - assurance_level
    - authentication_time
    - result
    - session_identifier

authentication_methods:
  - password
  - passkey
  - certificate
  - hardware_token
  - one_time_password
  - biometric
  - federated_identity
  - multi_factor
  - implementation_specific

rule authentication:
  authentication provides identity evidence
  and != authorisation

entity Credential:
  type: SecurityObject

rule secrets:
  raw passwords, private keys, and secret tokens SHOULD NOT be exposed
  in general-purpose security metadata

entity AuthorisationSecurityMetadata:
  type: SecurityMetadata
  may_include:
    - principal
    - resource
    - action
    - decision
    - policy
    - conditions
    - decision_time
    - reason

authorisation_decisions:
  - allow
  - deny
  - conditional
  - indeterminate

rule authorisation:
  successful authentication != authorised action

entity Permission:
  type: AccessControlMetadata
  may_include:
    - permission_identifier
    - action
    - resource
    - scope
    - condition
    - validity

entity SecurityRole:
  type: AccessControlMetadata
  may_include:
    - role_identifier
    - permissions
    - hierarchy
    - constraints

access_control_models:
  - discretionary_access_control
  - mandatory_access_control
  - role_based_access_control
  - attribute_based_access_control
  - capability_based_access_control
  - policy_based_access_control

rule access_control:
  policy definition != observed policy enforcement

# ---------- CIA / CRYPTOGRAPHY ----------
entity ConfidentialitySecurityMetadata:
  type: SecurityMetadata

entity IntegritySecurityMetadata:
  type: SecurityMetadata

entity AvailabilitySecurityMetadata:
  type: SecurityMetadata

rule confidentiality:
  confidentiality concerns protection from unauthorised disclosure

rule integrity:
  integrity concerns unauthorised or unexpected modification

rule availability:
  availability target != measured availability

entity CryptographicSecurityMetadata:
  type: SecurityMetadata
  may_include:
    - algorithm
    - key_identifier
    - key_length
    - mode
    - purpose
    - validity
    - cryptographic_state

rule cryptography:
  algorithm name alone != secure cryptographic configuration

rule encryption:
  encryption != hashing
  encryption != digital_signature

rule hash:
  hashing does_not provide confidentiality

entity CertificateSecurityMetadata:
  type: SecurityMetadata

rule certificate:
  certificate subject name != independently verified identity
  without trust validation


# ---------- CONTROLS / VULNERABILITY / THREAT / RISK ----------
entity SecurityControl:
  type: ControlMetadata
  may_include:
    - control_identifier
    - control_type
    - objective
    - implementation_state
    - effectiveness_state
    - owner
    - evidence

control_types:
  - preventive
  - detective
  - corrective
  - deterrent
  - compensating
  - recovery

rule control_documented:
  documented control != implemented control

rule control_effective:
  implemented control != effective control
  without supporting evidence

entity Vulnerability:
  type: SecurityWeakness
  may_include:
    - vulnerability_identifier
    - affected_resource
    - description
    - severity
    - exploitability
    - discovery_time
    - remediation_state
    - provenance

rule vulnerability:
  vulnerability != active exploitation

entity Threat:
  type: SecurityRiskEntity
  may_include:
    - threat_identifier
    - threat_type
    - target
    - capability
    - intent
    - likelihood
    - evidence

rule threat:
  threat possibility != confirmed security incident

entity SecurityRiskMetadata:
  type: RiskMetadata
  may_include:
    - asset
    - threat
    - vulnerability
    - likelihood
    - impact
    - risk_level
    - treatment
    - assessment_method
    - assessment_time

rule risk:
  assessed risk != observed incident

# ---------- EVENTS / INCIDENTS / ALERTS ----------
entity SecurityEvent:
  type: EventMetadata
  may_include:
    - event_identifier
    - event_type
    - event_time
    - principal
    - resource
    - action
    - result
    - source
    - evidence

entity SecurityIncident:
  subtype_of: SecurityEvent
  may_include:
    - incident_identifier
    - incident_type
    - affected_resources
    - detection_time
    - severity
    - evidence
    - containment
    - remediation
    - status

incident_status:
  - suspected
  - confirmed
  - contained
  - eradicated
  - recovered
  - closed
  - unknown

rule incident:
  suspected incident != confirmed incident

entity SecurityAlert:
  subtype_of: SecurityEvent

rule alert:
  alert != confirmed incident

# ---------- AUDIT / POLICY / COMPLIANCE ----------
entity SecurityAuditEvent:
  subtype_of: SecurityEvent

rule audit:
  audit metadata SHOULD preserve provenance
  and tamper-evidence where required

rule audit_absence:
  absence of audit record != proof event did not occur

entity SecurityPolicy:
  type: PolicyMetadata
  may_include:
    - policy_identifier
    - policy_name
    - scope
    - requirements
    - controls
    - authority
    - effective_from
    - effective_until
    - version

rule policy:
  policy requirement != observed implementation or enforcement state

entity SecurityComplianceMetadata:
  type: ComplianceMetadata
  may_include:
    - framework
    - requirement
    - evidence
    - assessment
    - status
    - assessment_time

rule compliance:
  compliance != complete security


# ---------- EVIDENCE / CONFIDENCE / PROVENANCE ----------
entity SecurityEvidence:
  type: EvidenceMetadata
  may_include:
    - evidence_identifier
    - source
    - collection_time
    - collector
    - integrity
    - chain_of_custody
    - interpretation

rule evidence:
  evidence interpretation != raw evidence

security_states:
  - secure_as_assessed
  - vulnerable
  - compromised
  - degraded
  - recovering
  - unknown

rule security_state:
  secure_as_assessed != guaranteed secure

entity SecurityMetadataConfidence:
  type: EpistemicMetadata
  range: [0.0, 1.0]

rule confidence_bounds:
  REQUIRE 0.0 <= confidence <= 1.0

entity SecurityMetadataProvenance:
  type: ProvenanceMetadata
  may_include:
    - source
    - collector
    - tool
    - tool_version
    - observation_time
    - transformations
    - assessments
    - events

rule provenance:
  SecurityMetadata SHOULD preserve evidence and assessment provenance

# ---------- VALIDATION ----------
validation:
  require:
    - identifiable_security_resource_or_subject

  reject:
    - claimed_identity_presented_as verified_identity_without evidence
    - authentication_presented_as authorisation
    - classification_presented_as permission
    - policy_presented_as enforcement_without evidence
    - documented_control_presented_as implemented_control_without evidence
    - implemented_control_presented_as effective_control_without evidence
    - vulnerability_presented_as exploitation_without evidence
    - threat_presented_as confirmed_incident
    - alert_presented_as confirmed_incident
    - compliance_presented_as complete_security
    - algorithm_name_presented_as secure_configuration
    - absence_of_audit_record_presented_as proof_of_non_occurrence

# ---------- SEMANTIC EQUIVALENCE ----------
SEMANTIC_EQUIVALENCE:
  "security metadata" ~= "metadata describing security state, controls, and evidence"
  "authentication metadata" ~= "metadata describing identity authentication"
  "authorisation metadata" ~= "metadata describing permissions and access decisions"
  "access control metadata" ~= "metadata describing controlled resource access"
  "security incident metadata" ~= "metadata describing security incidents"
  "security risk metadata" ~= "metadata describing security risk assessments"

  PRESERVE distinctions:
    identity_claim != verified_identity
    authentication != authorisation
    classification != permission
    policy != enforcement
    documented_control != implemented_control
    implemented_control != effective_control
    vulnerability != exploitation
    threat != incident
    alert != confirmed_incident
    risk != incident
    compliance != complete_security
    integrity != authenticity
    encryption != hashing
    encryption != digital_signature
    absence_of_log != proof_of_non_occurrence

# ---------- CONFIDENCE MODEL ----------
CONFIDENCE:
  explicit_security_metadata:
    score: 1.00
  verified_identity_evidence:
    score: 0.99
  cryptographically_verified_integrity:
    score: 0.99
  confirmed_incident_with_evidence:
    score: 0.99
  validated_control_effectiveness:
    score: 0.98
  vulnerability_scan_finding:
    score: <= 0.90
  unverified_alert:
    score: <= 0.75
  inferred_threat:
    score: <= 0.70
  incomplete_security_provenance:
    score: <= 0.60
    action: preserve uncertainty


# ---------- UPDATE MODEL ----------
UPDATE_MODEL:
  on_security_observation:
    - identify resource and principal
    - record observation time
    - collect evidence
    - classify security metadata
    - assign confidence
    - initialise provenance

  on_authentication:
    - record principal
    - record authentication method
    - record result and assurance level
    - create SecurityEvent
    - preserve provenance

  on_authorisation:
    - resolve authenticated principal
    - resolve requested resource and action
    - evaluate applicable policy
    - record decision and conditions
    - preserve audit evidence

  on_vulnerability_detection:
    - identify affected resource
    - record vulnerability and severity
    - preserve detection evidence
    - assess risk
    - update remediation state

  on_incident:
    - preserve detection evidence
    - classify incident status
    - identify affected resources
    - record containment and recovery
    - update provenance and confidence

# ---------- FLOW HASH ----------
FLOW_HASH:
  inputs:
    - ontology
    - security_metadata_entities
    - relationships
    - identity_rules
    - authentication_rules
    - authorisation_rules
    - control_rules
    - vulnerability_rules
    - risk_rules
    - incident_rules
    - validation
    - semantic_equivalence
    - confidence_model
    - update_model

  canonicalisation:
    - preserve_security_metadata_identifiers
    - preserve_resource_and_principal_identifiers
    - preserve_policy_versions
    - preserve_event_order
    - preserve_assessment_times
    - preserve_evidence_provenance
    - preserve_control_states
    - preserve_rule_order

  output:
    deterministic_semantic_hash

# ---------- AI CONSUMPTION ----------
AI_CONSUMPTION:
  interpret_as:
    - security metadata ontology
    - identity, authentication, authorisation, and access-control model
    - confidentiality, integrity, availability, and cryptographic metadata structure
    - vulnerability, threat, risk, incident, audit, compliance, and provenance model

  operations:
    - identify secured resources and principals
    - resolve security classifications
    - distinguish authentication and authorisation
    - resolve roles and permissions
    - inspect access-control policy and enforcement
    - inspect confidentiality, integrity, and availability metadata
    - inspect cryptographic and certificate metadata
    - evaluate security controls
    - resolve vulnerabilities, threats, and risks
    - distinguish alerts from confirmed incidents
    - traverse audit events
    - evaluate compliance evidence
    - trace security provenance
    - preserve uncertainty

  constraints:
    - do_not_equate_identity_claim_with verified_identity
    - do_not_equate_authentication_with authorisation
    - do_not_equate_policy_with enforcement
    - do_not_equate_vulnerability_with exploitation
    - do_not_equate_alert_with confirmed_incident
    - do_not_equate_compliance_with complete_security
    - preserve_resources_principals_controls_events_evidence_and_provenance

# ---------- QUERY MODEL ----------
query:
  input:
    - security_metadata_identifier
    - resource_identifier
    - principal_identifier
    - classification
    - authentication_state
    - authorisation_state
    - vulnerability_identifier
    - threat_identifier
    - incident_identifier
    - assessment_time

  resolve:
    1. identify SecuredResource
    2. resolve SecurityPrincipal and identity evidence
    3. inspect authentication and authorisation
    4. resolve permissions, roles, controls, and policies
    5. inspect confidentiality, integrity, availability, and cryptography
    6. inspect vulnerabilities and threats
    7. assess risk and incident evidence
    8. traverse audit and compliance metadata
    9. inspect provenance and confidence
    10. return security state

  output:
    - secured_resource
    - principal
    - classification
    - authentication
    - authorisation
    - permissions
    - controls
    - vulnerabilities
    - threats
    - risk
    - incidents
    - audit
    - compliance
    - provenance
    - confidence

# ---------- INFERENCE ----------
inference:
  IF authentication succeeds
  THEN establish authenticated_principal_candidate
  BUT do_not infer authorisation

  IF vulnerability exists
  AND threat has capability to exploit it
  THEN increase risk candidate
  according_to likelihood and impact

  IF alert has corroborating evidence
  AND incident criteria are satisfied
  THEN promote incident status
  according_to policy

  IF evidence is incomplete or conflicting
  THEN preserve uncertainty
  AND reduce confidence

# ---------- OUTPUT CONTRACT ----------
output:
  ontology_entity: SecurityMetadata
  metadata_identity: machine_interpretable
  resource_identity: explicit
  principal_identity: evidence_aware
  authentication_authorisation: distinguishable
  classifications_roles_permissions: explicit
  confidentiality_integrity_availability: explicit
  cryptographic_metadata: configuration_aware
  controls: implementation_and_effectiveness_distinct
  vulnerabilities_threats_risks: distinguishable
  incidents_alerts: evidence_aware
  audit_and_compliance: traceable
  policies: versioned
  provenance: preserved
  uncertainty: explicit
  security_reasoning: enabled

end flow