entity
Human, org, agent, model, tool, device, dataset, credential, instrument, asset.
KYE™ Ontology Profile™ · v1.0
How KYE™ names entities. Five classes. One URN scheme. Same shape across SDKs, schemas. And the OpenAPI spec.
You learn: The page's points, one at a time. You can: Step through them.
Step 1 of 8
KYE Protocol™
What is ontology?
How we name things.
Step 2 of 8
KYE Protocol™
What is a class?
A kind of entity.
Step 3 of 8
KYE Protocol™
How many classes are there?
Five.
Step 4 of 8
KYE Protocol™
What is a URN?
A name with five parts.
Step 5 of 8
KYE Protocol™
What goes in part one?
The class.
Step 6 of 8
KYE Protocol™
What goes in part two?
The trust domain.
Step 7 of 8
KYE Protocol™
What goes in part three?
The subclass.
Step 8 of 8
KYE Protocol™
What goes in part four?
The local name.
KYE™ Ontology Profile™ defines how entities, authorities, capabilities, scopes, states, decisions and evidence relate across systems, sectors and profiles. Schemas make data valid. Ontologies make data meaningful.
Plain Q&A
Short questions. Short answers.
Plain take
Five classes. One URN. Same shape, top to bottom.
1 · Where the semantic layer sits
The ontology layer is not a replacement for any of the others. It gives them shared meaning so different systems can agree on what an entity, agent, authority, capability, state, decision or evidence pack actually is.
DictionariesAllowed terms. Stable names KYE™ recognises.
TaxonomiesParent / child classification of those names.
KYE™ Ontology Profile™Semantic relationships between names — what they mean, what they require, what they are not.
Schemas (JSON Schema)Runtime validation. Bytes on the wire.
Knowledge graphLive instances of entities, authorities, decisions.
Policy engineDecisions over meaning + state.
Runtime gatewayEnforcement at the decision point.
Evidence Pack™Signed semantic artefact a regulator can replay offline.
2 · The twelve ontology domains
Domains carve the semantic surface so terms cannot drift across categories silently. delegated_payment_authority lives in authority. payment_initiation lives in capability. amount_limit lives in scope. Mappings between domains are explicit.
Human, org, agent, model, tool, device, dataset, credential, instrument, asset.
Delegation, mandate, consent, approval, permission, entitlement, licence, power_of_attorney.
payment_initiation, card_purchase, data_access, contract_signing, tool_invocation.
amount_limit, time_window, jurisdiction, data_class, environment, retention_limit.
entity, authority, delegation, credential, capability, risk, recovery, continuity, discovery, certification.
allow, allow_with_constraints, require_approval, deny, continuity_*.
audit_event, decision_map, evidence_pack, payload_hash, signature, intent_trace.
Drift types and continuity dimensions.
Discovery modes, risk-discovery types, masking classes.
Connector Profile™ family kinds.
payments, open_finance, legal, health, pensions, cyber, critical_infrastructure, sovereign_ai, telecom, pharma_gxp.
Conformance / certification artefacts.
3 · Mapping types — interactive
Every external-system term mapped into KYE™ declares exactly one mapping type. The runtime enforces it. An OAuth scope may be related_not_identical to a delegated payment authority — presenting the scope alone, without the companion authority record, is denied.
When does it apply?
Source and KYE™ term are interchangeable for runtime purposes. Rare in practice; usually only safe within a single trust domain.
Example: oidc_id_token.sub ≡ kye:term:entity:human when both reference the same KYE-issued URN.
Runtime effect: presenting either term resolves to the same KYE™ term. No companion object required.
Overlap exists but the source term . Companion KYE™ objects MUST be presented.
OAuth scope ↔ ; companions required: , , , . payments:write kye:term:capability:payment_initiation KYEAuthorityGrant KYEScope KYEStateSnapshot KYEPolicyDecision
if any companion is missing, deny with reason code . external_term_not_equivalent
When does it apply?
The source term MUST NOT be treated as the KYE™ term. Asserting equivalence is itself a policy violation.
Example: oauth.scope:profile.read ≠ kye:term:legal:power_of_attorney.
Runtime effect: deny with reason code semantic_equivalence_rejected.
When does it apply?
A label-level alias only — same KYE™ term under a different display name.
Example: "payment mandate" alias of kye:term:authority:delegated_payment_authority.
Runtime effect: presenting either resolves identically; no policy gate.
When does it apply?
The source term is a narrower meaning than the KYE™ term.
Example: card_purchase subsumes the broader kye:term:capability:payment_initiation only for card-rail subset.
Runtime effect: resolves to the KYE™ term but only within the declared narrow scope.
When does it apply?
The source term is a broader meaning than the KYE™ term.
Example: generic.access subsumed_by kye:term:authority:delegated_payment_authority — presenting the broad term is insufficient.
Runtime effect: require additional KYE™ objects to narrow the resolution; deny if absent.
4 · Schemas (Apache 2.0, public mirror)
ontology-profile.json — KYE™ Ontology Profile™ manifestontology-term.json — one canonical termontology-relationship.json — (subject, predicate, object) triple with constraintsontology-mapping.json — external term → KYE™ term mapping with mapping_type + companion-objectssemantic-assertion.json — decision-bound semantics, hash-chained into the audit ledgerjsonld-context.json — JSON-LD context for semantic interoperabilityRDF / OWL export is supported as an optional serialization for research, public-sector. And regulator integrations. KYE™ is JSON-native at runtime and ontology-aware at the semantic layer.
4b · Canonical relationship terms (derived)
internal.Per Constitution (Transitive Update Cascade), this block regenerates automatically when the ontology dictionary changes. The TypeScript + Python SDK vocabulary modules regenerate at the same time. No hand-edit between the markers below — edit the dictionary instead.
delegates_to — Principal A grants authority to act to Principal B within a bounded scope.accountable_for — Principal is the responsible accountable owner of an actor or workflow.authorised_by — Action authorised by a specific authority grant.evidenced_by — Decision evidenced by a specific Evidence Pack™.scoped_to — Authority grant is scoped to a specific capability set.supersedes — New authority/policy supersedes a previous one.depends_on — Object A depends on Object B for resolution.cascades_to — A change to Object A automatically propagates to Object B in the same commit, per Constitution (Transitive Update Cascade).interacts_with — Object A engages in bidirectional runtime exchange with Object B (one of the v1.1 typed-edge relationship-map vocabulary; the bidirectional sibling of produces/consumes).Cascade source: internal · Settled by: scripts/build-ontology-derivative.mjs · Coverage gate: cascade-coverage
5 · Apps that compose this profile
What it is. Why it matters. What to do next.
Define and govern terms, relationships, mappings and semantic assertions.
Map OAuth scopes, IAM roles, payment mandates, legal delegations and healthcare consents into KYE™ without losing meaning.
Graph view of the ontology + live instances; semantic-path search + risk-ranked traversal.
Conformance fixture suite + certification track for ontology-correct implementations.
6 · Open / paid boundary
One sentence: a signed, replayable proof of decision.
Open source
Commercial track
7 · How it strengthens Continuity + Discoverability
What it is. Why it matters. What to do next.
Without ontology: "find all payment permissions." With ontology: "find all active delegated payment authorities, including mapped payment mandates, excluding ordinary API scopes that do not prove principal authority."
User says "book travel." Agent interprets "buy airline ticket." Ontology checks whether book implies prepare-only, reserve-only, or purchase authority — preventing intent / authority drift.
Each runtime decision emits a signed KYESemanticAssertion, hash-chained into the audit ledger; a regulator can re-derive what the decision meant, not just what it returned.
KYE™ is JSON-native at runtime, JSON-LD-ready for semantic interoperability, and graph-aware for authority discovery, continuity and evidence.
Where to go next
What it is. Why it matters. What to do next.
Start in shadow mode. We’ll deliver your first Evidence Pack™ in 4–8 weeks.
Canonical KYE™ surfaces referenced on this page: Evidence Pack™ · KYE Protocol™.