Governance Ontology and Decision Graph

Overview

The ontology is the authoritative business model of Kavach; all storage models, APIs, graph projections, UI views, and AI reasoning are derived representations. It is intentionally independent of a graph database, relational schema, API transport, or UI. Storage engines project the ontology; they do not define it.

Kavach governance ontology graph

Selecting a node highlights its connected nodes and relationships, making the web of relationships easier to visualise.

Entity Taxonomy

Every first-class entity has stable identity, ownership, lifecycle state, and versioning rules.

Actor

External identity provider, human operator, service account, or MCP agent. Lifecycle: active, disabled, unknown.

Prompt & PromptVersion

A Prompt is a logical family; changes to content create a new PromptVersion. Lifecycle: DRAFT, ACTIVE, DEPRECATED, ARCHIVED.

Model & ModelVersion

Model metadata changes that affect reproducibility create a new ModelVersion. Lifecycle: DRAFT, ACTIVE, DEPRECATED, ARCHIVED.

Dataset

Versioned dataset metadata for governed evaluation use. Lifecycle: DRAFT, ACTIVE, DEPRECATED, ARCHIVED.

Experiment & ExperimentCandidate

An Experiment defines a comparison space. An ExperimentCandidate is an immutable AI configuration binding prompt, model, dataset, evaluation provider, and runtime parameters.

EvaluationResult & EvaluationRun

EvaluationResult is metric evidence for a single execution. EvaluationRun links an experiment candidate to a governed evaluation attempt.

GovernanceDecision

Captures the decision type, status, ontology-aligned target, evidence references, policy references, provenance, confidence, and supersession metadata.

GovernancePolicy

A versioned, deterministic policy definition for producing governance-oriented outcomes from structured evidence. Evaluated by GovernancePolicyEvaluator.

Relationships

Relationships are directed and named from source to target. They describe durable semantics; events describe temporal facts.

SUBMITS            → EvaluationResult
DEPENDS_ON         → PromptVersion, ModelVersion, Dataset
CONTAINS           → ExperimentCandidate
EVALUATED_BY       → EvaluationProvider
PRODUCES           → GovernanceDecision
GOVERNED_BY        → GovernancePolicy
SUPERSEDES         → GovernanceDecision (older)
EVIDENCE_FOR       → GovernanceDecision

Actions and Events

Actions are imperative (e.g., CreateExperiment, EvaluateDecision). Events are past-tense (e.g., ExperimentCreated, EvaluationCompleted).

ExperimentCreated → Experiment
EvaluationCompleted → EvaluationResult
DecisionFinalized → GovernanceDecision
DriftDetected → DriftAnalysis
JobQueued → Job
MCPAuditStarted → MCPAuditRecord

Deterministic Projection

The graph is a projection of relational state, not a second source of truth. Given the same relational records, projection always produces the same nodes and relationships. This determinism is what makes the graph safe to rebuild and verify.

Hashing & Reconciliation

Each projected entity carries a projection hash computed from its canonical fields. Alongside the node hash, Kavach hashes the full set of a node's relationships. A change in either hash marks the node for reconciliation, allowing incremental repair instead of full re-projection.

Ontology Versioning

The ontology version follows SemVer. Patch changes clarify wording or add non-normative examples. Minor changes add optional entities, relationships, attributes, actions, or events without changing existing semantics. Major changes rename or remove entities, relationships, required fields, or lifecycle meanings.

Existing entity and relationship names remain valid for the full major version. Deprecated concepts must remain documented with replacement guidance for at least one major version.