KYE™ Ontology Profile™ · v1.0

Semantic authority, not just permissions.

How KYE™ names entities. Five classes. One URN scheme. Same shape across SDKs, schemas. And the OpenAPI spec.

Ontology Profile, point by point

Demo data

You learn: The page's points, one at a time. You can: Step through them.

  1. Step 1 of 8

    KYE Protocol™

    What is ontology?

    How we name things.

  2. Step 2 of 8

    KYE Protocol™

    What is a class?

    A kind of entity.

  3. Step 3 of 8

    KYE Protocol™

    How many classes are there?

    Five.

  4. Step 4 of 8

    KYE Protocol™

    What is a URN?

    A name with five parts.

  5. Step 5 of 8

    KYE Protocol™

    What goes in part one?

    The class.

  6. Step 6 of 8

    KYE Protocol™

    What goes in part two?

    The trust domain.

  7. Step 7 of 8

    KYE Protocol™

    What goes in part three?

    The subclass.

  8. Step 8 of 8

    KYE Protocol™

    What goes in part four?

    The local name.

How this widget is built
Demonstrates
KYE Protocol™
Components
  • The points this page makes
Flow
Each point in order, as the page sets it out. Architecture diagram
Used on

KYE™ Ontology Profile™ defines how entities, authorities, capabilities, scopes, states, decisions and evidence relate across systems, sectors and profiles. Schemas make data valid. Ontologies make data meaningful.

Plain Q&A

Plain Q&A

Short questions. Short answers.

  • What is ontology? How we name things.
  • What is a class? A kind of entity.
  • How many classes are there? Five.
  • What is a URN? A name with five parts.
  • What goes in part one? The class.
  • What goes in part two? The trust domain.
  • What goes in part three? The subclass.
  • What goes in part four? The local name.
  • Is it open? Yes. The vocab is open.

Plain take

Plain take

Five classes. One URN. Same shape, top to bottom.

  • Every entity is a URN.
  • Every URN has five parts.
  • Same names in TypeScript. Same names in Python.
  • Same names in the OpenAPI spec.

1 · Where the semantic layer sits

Schemas. Dictionaries. Taxonomies. Ontology. Graph. Policy. Runtime.

The ontology layer is not a replacement for any of the others. It gives them shared meaning so different systems can agree on what an entity, agent, authority, capability, state, decision or evidence pack actually is.

DictionariesAllowed terms. Stable names KYE™ recognises.

TaxonomiesParent / child classification of those names.

KYE™ Ontology Profile™Semantic relationships between names — what they mean, what they require, what they are not.

Schemas (JSON Schema)Runtime validation. Bytes on the wire.

Knowledge graphLive instances of entities, authorities, decisions.

Policy engineDecisions over meaning + state.

Runtime gatewayEnforcement at the decision point.

Evidence Pack™Signed semantic artefact a regulator can replay offline.

2 · The twelve ontology domains

Every KYE™ term belongs to exactly one domain.

Domains carve the semantic surface so terms cannot drift across categories silently. delegated_payment_authority lives in authority. payment_initiation lives in capability. amount_limit lives in scope. Mappings between domains are explicit.

entity

Human, org, agent, model, tool, device, dataset, credential, instrument, asset.

authority

Delegation, mandate, consent, approval, permission, entitlement, licence, power_of_attorney.

capability

payment_initiation, card_purchase, data_access, contract_signing, tool_invocation.

scope

amount_limit, time_window, jurisdiction, data_class, environment, retention_limit.

state

entity, authority, delegation, credential, capability, risk, recovery, continuity, discovery, certification.

decision

allow, allow_with_constraints, require_approval, deny, continuity_*.

evidence

audit_event, decision_map, evidence_pack, payload_hash, signature, intent_trace.

continuity

Drift types and continuity dimensions.

discoverability

Discovery modes, risk-discovery types, masking classes.

connector

Connector Profile™ family kinds.

sector

payments, open_finance, legal, health, pensions, cyber, critical_infrastructure, sovereign_ai, telecom, pharma_gxp.

certification

Conformance / certification artefacts.

3 · Mapping types — interactive

Six explicit mapping types. Including "not equivalent."

Every external-system term mapped into KYE™ declares exactly one mapping type. The runtime enforces it. An OAuth scope may be related_not_identical to a delegated payment authority — presenting the scope alone, without the companion authority record, is denied.

When does it apply?

Source and KYE™ term are interchangeable for runtime purposes. Rare in practice; usually only safe within a single trust domain.

Example: oidc_id_token.sub ≡ kye:term:entity:human when both reference the same KYE-issued URN.

Runtime effect: presenting either term resolves to the same KYE™ term. No companion object required.

does not prove the KYE™ term

Overlap exists but the source term . Companion KYE™ objects MUST be presented.

Example:

OAuth scope ↔ ; companions required: , , , . payments:write kye:term:capability:payment_initiation KYEAuthorityGrant KYEScope KYEStateSnapshot KYEPolicyDecision

Runtime effect:

if any companion is missing, deny with reason code . external_term_not_equivalent

When does it apply?

The source term MUST NOT be treated as the KYE™ term. Asserting equivalence is itself a policy violation.

Example: oauth.scope:profile.read ≠ kye:term:legal:power_of_attorney.

Runtime effect: deny with reason code semantic_equivalence_rejected.

When does it apply?

A label-level alias only — same KYE™ term under a different display name.

Example: "payment mandate" alias of kye:term:authority:delegated_payment_authority.

Runtime effect: presenting either resolves identically; no policy gate.

When does it apply?

The source term is a narrower meaning than the KYE™ term.

Example: card_purchase subsumes the broader kye:term:capability:payment_initiation only for card-rail subset.

Runtime effect: resolves to the KYE™ term but only within the declared narrow scope.

When does it apply?

The source term is a broader meaning than the KYE™ term.

Example: generic.access subsumed_by kye:term:authority:delegated_payment_authority — presenting the broad term is insufficient.

Runtime effect: require additional KYE™ objects to narrow the resolution; deny if absent.

4 · Schemas (Apache 2.0, public mirror)

Five normative objects + JSON-LD context. Validated in CI.

RDF / OWL export is supported as an optional serialization for research, public-sector. And regulator integrations. KYE™ is JSON-native at runtime and ontology-aware at the semantic layer.

4b · Canonical relationship terms (derived)

The terms below are derived from internal.

Per Constitution (Transitive Update Cascade), this block regenerates automatically when the ontology dictionary changes. The TypeScript + Python SDK vocabulary modules regenerate at the same time. No hand-edit between the markers below — edit the dictionary instead.

  • delegates_to — Principal A grants authority to act to Principal B within a bounded scope.
  • accountable_for — Principal is the responsible accountable owner of an actor or workflow.
  • authorised_by — Action authorised by a specific authority grant.
  • evidenced_by — Decision evidenced by a specific Evidence Pack™.
  • scoped_to — Authority grant is scoped to a specific capability set.
  • supersedes — New authority/policy supersedes a previous one.
  • depends_on — Object A depends on Object B for resolution.
  • cascades_to — A change to Object A automatically propagates to Object B in the same commit, per Constitution (Transitive Update Cascade).
  • interacts_with — Object A engages in bidirectional runtime exchange with Object B (one of the v1.1 typed-edge relationship-map vocabulary; the bidirectional sibling of produces/consumes).

Cascade source: internal · Settled by: scripts/build-ontology-derivative.mjs · Coverage gate: cascade-coverage

5 · Apps that compose this profile

Four planned apps. Contracts open; engines paid.

What it is. Why it matters. What to do next.

KYE™ Ontology Registry™

Define and govern terms, relationships, mappings and semantic assertions.

KYE™ Semantic Authority Mapper™

Map OAuth scopes, IAM roles, payment mandates, legal delegations and healthcare consents into KYE™ without losing meaning.

KYE™ Semantic Graph™

Graph view of the ontology + live instances; semantic-path search + risk-ranked traversal.

KYE™ Ontology Conformance™

Conformance fixture suite + certification track for ontology-correct implementations.

6 · Open / paid boundary

The contracts are open. The semantic engine is paid.

One sentence: a signed, replayable proof of decision.

Open source

Open

  • KYE™ Ontology Profile™ schema
  • Term + relationship + mapping + semantic-assertion schemas
  • JSON-LD context
  • Predicate dictionary + 6 mapping types
  • Reason-code dictionary
  • Sample terms + sample mappings
  • RDF / OWL optional export examples
  • Basic conformance fixtures

Commercial track

Paid

  • KYE™ Ontology Registry™ Pro
  • KYE™ Semantic Authority Mapper™
  • KYE™ Semantic Graph™ engine
  • False-equivalence detection engine
  • Cross-profile mapping reconciliation
  • Sector ontology packs
  • Tenant ontology overlays
  • Risk-weighted traversal
  • Certification workflow

7 · How it strengthens Continuity + Discoverability

Ontology makes discovery meaningful and continuity portable.

What it is. Why it matters. What to do next.

+ Discoverability

Without ontology: "find all payment permissions." With ontology: "find all active delegated payment authorities, including mapped payment mandates, excluding ordinary API scopes that do not prove principal authority."

+ Continuity

User says "book travel." Agent interprets "buy airline ticket." Ontology checks whether book implies prepare-only, reserve-only, or purchase authority — preventing intent / authority drift.

+ Evidence

Each runtime decision emits a signed KYESemanticAssertion, hash-chained into the audit ledger; a regulator can re-derive what the decision meant, not just what it returned.

KYE™ is JSON-native at runtime, JSON-LD-ready for semantic interoperability, and graph-aware for authority discovery, continuity and evidence.

Where to go next

Adjacent reading.

What it is. Why it matters. What to do next.

Ready to see your AI agents flagged?

Start in shadow mode. We’ll deliver your first Evidence Pack™ in 4–8 weeks.

Canonical KYE™ surfaces referenced on this page: Evidence Pack™ · KYE Protocol™.