# Identity Atlas core ontology
#
# The canonical, version-controlled description of the built-in graph model that
# the PostgreSQL migrations, the ingest validation and the crawlers implement.
# It DESCRIBES the model; it does not drive it. PostgreSQL stays the store.
#
# Conventions (enforced by `npm run ontology:check` in app/api — see
# docs/contributing/maintaining-the-ontology.md):
#   * Namespace https://identityatlas.io/ontology# , prefix ia: .
#   * A class that maps to a table carries ia:table. Its node IRI stands for the
#     row, so the table's identifier column (ia:identifierColumn, "id") is not a
#     property.
#   * A property that maps to a column is named EXACTLY like the column
#     (camelCase as in the database) and carries ia:sqlType. One property per
#     column name, shared by every core table that has that column — its
#     rdfs:domain lists them. So Principals.accountEnabled is ia:accountEnabled.
#   * A foreign-key column is an owl:ObjectProperty whose range is the class it
#     points at; every other column is an owl:DatatypeProperty.
#   * A value stored in a discriminator / type column is ia:typeValue on the
#     class (principalType, resourceType), on the relationship property
#     (relationshipType) or on the named individual (assignmentType, origin, …).
#   * Named individuals of a closed value list are called <Scheme>_<value>.
#   * Relationship-type properties are lowerCamel of the stored value
#     ('HasAppRole' -> ia:hasAppRole) and say which edge table stores them.
#   * Every term is rdfs:isDefinedBy <https://identityatlas.io/ontology>. Future
#     runtime-defined extensions live in their own ontology and namespace and
#     never add triples about core terms' definitions (docs/architecture/core-ontology.md).
#   * Three layers. THINGS (node classes, their types and templates) and
#     STRUCTURE (relationship types, memberships) may grow. HOLDING may not:
#     an account reaches a resource only through ResourceAssignments, and its
#     assignmentType is exactly Direct, Indirect or Eligible. A new kind of
#     right is a new resource plus a relationship, never a new way of holding.
#   * Beside the graph, KNOWLEDGE (ia:Knowledge): what a source — an interview —
#     SAID about a context or a person, as claims with provenance. A claim is no
#     fact until someone confirms it, and it never holds anything: a confirmed
#     role claim becomes an ia:ContextRole that names it (sourceClaimId).
#   * The scissors comment lines (start / end markers) mark excerpts that
#     docs/concepts/ontology.md quotes verbatim (pymdownx.snippets).

@prefix ia:      <https://identityatlas.io/ontology#> .
@prefix owl:     <http://www.w3.org/2002/07/owl#> .
@prefix rdf:     <http://www.w3.org/1999/02/22-rdf-syntax-ns#> .
@prefix rdfs:    <http://www.w3.org/2000/01/rdf-schema#> .
@prefix xsd:     <http://www.w3.org/2001/XMLSchema#> .
@prefix dcterms: <http://purl.org/dc/terms/> .

<https://identityatlas.io/ontology>
    a owl:Ontology ;
    dcterms:title "Identity Atlas core ontology"@en ;
    rdfs:comment "The built-in Identity Atlas graph model: systems, accounts (principals), resources, persons (identities) and contexts, and the edge tables that connect them. Describes what the PostgreSQL schema and the ingest API implement today."@en ;
    owl:versionInfo "2.4.0" ;
    owl:versionIRI <https://identityatlas.io/ontology/2.4.0> ;
    dcterms:license <https://github.com/Fortigi/IdentityAtlas/blob/main/LICENSE> .

# jsonb columns use rdf:JSON (RDF 1.1 / JSON-LD 1.1). It is not in the OWL 2
# datatype map, so it is declared here; a strict DL reasoner may need its
# "ignore unsupported datatypes" option.
rdf:JSON a rdfs:Datatype .
# dcterms terms used on the ontology header, declared so OWL 2 DL tools do not
# have to guess their kind.
dcterms:title a owl:AnnotationProperty .
dcterms:license a owl:AnnotationProperty .

# ─── Mapping annotations ──────────────────────────────────────────────────────
# Describe how an ontology term maps onto the implementation. They are
# annotations, so OWL reasoners ignore them; the validator reads them.

ia:table a owl:AnnotationProperty ;
    rdfs:label "table" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The PostgreSQL table whose rows are instances of this class." .
ia:identifierColumn a owl:AnnotationProperty ;
    rdfs:label "identifier column" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The column that identifies a row of this class. It is represented by the instance IRI, not by a property." .
ia:identifierSqlType a owl:AnnotationProperty ;
    rdfs:label "identifier SQL type" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The PostgreSQL type of the identifier column. A foreign-key column pointing at this class must have the same type." .
ia:ingestEntity a owl:AnnotationProperty ;
    rdfs:label "ingest entity" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The ingest API entity type (POST /api/ingest/<entity>) that writes this class." .
ia:discriminator a owl:AnnotationProperty ;
    rdfs:label "discriminator" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The column whose value selects the subclass of this class (see ia:typeValue on the subclasses)." .
ia:openVocabulary a owl:AnnotationProperty ;
    rdfs:label "open vocabulary" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "True when the discriminator accepts any value: the declared subclasses are the built-in values the application itself relies on, not an allow-list." .
ia:typeColumn a owl:AnnotationProperty ;
    rdfs:label "type column" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On an edge class: the column that holds the relationship type. Its allowed values are the ia:typeValue of every property with ia:storedIn this class." .
ia:sourceProperty a owl:AnnotationProperty ;
    rdfs:label "source property" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On an edge class: the foreign-key property naming the edge's source (subject) node." .
ia:targetProperty a owl:AnnotationProperty ;
    rdfs:label "target property" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On an edge class: the foreign-key property naming the edge's target (object) node." .
ia:sqlType a owl:AnnotationProperty ;
    rdfs:label "SQL type" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The column's PostgreSQL data type exactly as information_schema.columns.data_type reports it." .
ia:ingestAlias a owl:AnnotationProperty ;
    rdfs:label "ingest alias" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An ingest field that is not a column but is resolved into this column (an external id turned into the deterministic internal id)." .
ia:typeValue a owl:AnnotationProperty ;
    rdfs:label "type value" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The exact string stored in the database for this class, relationship type or enumerated value." .
ia:storedIn a owl:AnnotationProperty ;
    rdfs:label "stored in" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On a relationship-type property: the edge class whose rows carry it." .
ia:valueScheme a owl:AnnotationProperty ;
    rdfs:label "value scheme" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On a datatype property: the class whose named individuals are the column's closed list of allowed values." .
ia:denotesClass a owl:AnnotationProperty ;
    rdfs:label "denotes class" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On an ia:EntityKind value: the core class that the stored string names." .
ia:producedBy a owl:AnnotationProperty ;
    rdfs:label "produced by" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On a context type: the name of a context-algorithm plugin that emits it (contexts/plugins/registry.js)." .
ia:allowedTargetType a owl:AnnotationProperty ;
    rdfs:label "allowed target type" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On a context type: an ia:EntityKind value that the targetType of such a context may have. A context groups one kind of entity." .
ia:emittedBy a owl:AnnotationProperty ;
    rdfs:label "emitted by" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On a principal, resource or context type: the type of a crawler (tools/crawlers/<dir>/crawler.json) that writes it — a fixed value or the default of a built-in mapping. Checked against the manifest's emits block." .
ia:passthroughFrom a owl:AnnotationProperty ;
    rdfs:label "passes through from" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On ia:Principal, ia:Resource or ia:Context: a crawler that stores values for the type column taken from source data or its configuration, so values beyond the defined types arrive from it (a manifest's emits.open)." .
ia:template a owl:AnnotationProperty ;
    rdfs:label "template" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "true on a class that is a template: the level at which the application reasons about a kind of node (its screens, reports, risk scoring and plugins), above the type values the sources use. Every type has exactly one template among its ancestors or is one itself." .
ia:expandsAccess a owl:AnnotationProperty ;
    rdfs:label "expands access" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On a resource template or type: true when holding the resource reaches what it contains (a group's members get its access); false when holding it never does (owning a group is not being in it). Inherited by the types below; checked against the effective-access engine's lists." .
ia:accountabilityDefault a owl:AnnotationProperty ;
    rdfs:label "accountability default" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On a principal type: the ia:Accountability value an account of this type has until something settles it (the source, an Owner or Sponsor link, or a person). Absent where the type alone cannot say — an AI agent." .
ia:denotesTemplate a owl:AnnotationProperty ;
    rdfs:label "denotes template" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "On an ia:ContextCategory value: the template class (ia:template true) the stored string names." .
ia:status a owl:AnnotationProperty ;
    rdfs:label "status" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Lifecycle note for a term that exists in the implementation but is not (fully) in use: 'reserved' or 'unused'. Retired terms use owl:deprecated." .

# ─── Abstract structure ───────────────────────────────────────────────────────

ia:Node a owl:Class ;
    rdfs:label "Node" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A node table of the Identity Atlas graph: Systems, Principals, Resources, Identities, Contexts." .
ia:Edge a owl:Class ;
    rdfs:label "Edge" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An edge table of the Identity Atlas graph. Edges carry their own columns, so each edge row is an instance in its own right (the edge-with-fields pattern)." .

# ─── Node classes ─────────────────────────────────────────────────────────────

ia:System a owl:Class ; rdfs:subClassOf ia:Node ;
    rdfs:label "System" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A connected authorization source (Entra ID, Omada, a SQL database, a CSV feed …). Principals, resources and synced contexts belong to one system." ;
    ia:table "Systems" ; ia:identifierColumn "id" ; ia:identifierSqlType "integer" ; ia:ingestEntity "systems" .

# --8<-- [start:principal]
ia:Principal a owl:Class ; rdfs:subClassOf ia:Node ;
    rdfs:label "Principal" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An account in a source system: a user, service principal, managed identity, AI agent, guest, shared mailbox …" ;
    ia:table "Principals" ; ia:identifierColumn "id" ; ia:identifierSqlType "uuid" ; ia:ingestEntity "principals" ;
    ia:discriminator "principalType" ;
    ia:passthroughFrom "csv", "custom-connector", "midpoint", "mssql", "omada", "scim" .
# --8<-- [end:principal]

ia:Resource a owl:Class ; rdfs:subClassOf ia:Node ;
    rdfs:label "Resource" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Anything that grants access — a group, a directory role, an app role, a permission — and also a business role (governance construct)." ;
    ia:table "Resources" ; ia:identifierColumn "id" ; ia:identifierSqlType "uuid" ; ia:ingestEntity "resources" ;
    ia:discriminator "resourceType" ; ia:openVocabulary true ;
    ia:passthroughFrom "csv", "custom-connector", "midpoint", "mssql", "omada" .

ia:Identity a owl:Class ; rdfs:subClassOf ia:Node ;
    rdfs:label "Identity" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A real person, aggregated from one or more accounts (principals) through IdentityMembers." ;
    ia:table "Identities" ; ia:identifierColumn "id" ; ia:identifierSqlType "uuid" ; ia:ingestEntity "identities" .

ia:Context a owl:Class ; rdfs:subClassOf ia:Node ;
    rdfs:label "Context" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A grouping of one kind of entity — a department, an OU, a tag, a cluster, a logical application. Synced, generated by a plugin, or manual. contextType is an open vocabulary; the values the application itself knows are its subclasses. A child context has the same targetType as its parent (the routes and plugins keep this, the database does not enforce it), and the tree is acyclic (enforced at commit by trg_Contexts_reject_cycle)." ;
    ia:table "Contexts" ; ia:identifierColumn "id" ; ia:identifierSqlType "uuid" ; ia:ingestEntity "contexts" ;
    ia:discriminator "contextType" ; ia:openVocabulary true ;
    ia:passthroughFrom "csv", "custom-connector", "midpoint", "mssql", "omada" .

# ─── Edge classes ─────────────────────────────────────────────────────────────

ia:ResourceAssignment a owl:Class ; rdfs:subClassOf ia:Edge ;
    rdfs:label "Resource assignment" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Who holds what: one account (principalId) or one person (identityId) — exactly one of the two — holds one resource, Direct / Indirect / Eligible, optionally governed." ;
    ia:table "ResourceAssignments" ;
    ia:ingestEntity "resource-assignments", "resource-assignments-identity" ;
    ia:sourceProperty ia:principalId, ia:identityId ; ia:targetProperty ia:resourceId .

ia:ResourceRelationship a owl:Class ; rdfs:subClassOf ia:Edge ;
    rdfs:label "Resource relationship" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A typed link from a parent resource to a child resource." ;
    ia:table "ResourceRelationships" ; ia:ingestEntity "resource-relationships" ;
    ia:typeColumn "relationshipType" ;
    ia:sourceProperty ia:parentResourceId ; ia:targetProperty ia:childResourceId .

ia:PrincipalRelationship a owl:Class ; rdfs:subClassOf ia:Edge ;
    rdfs:label "Principal relationship" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A responsibility link between two accounts: relatedPrincipalId is the Owner / Sponsor OF principalId." ;
    ia:table "PrincipalRelationships" ; ia:ingestEntity "principal-relationships" ;
    ia:typeColumn "relationshipType" ;
    ia:sourceProperty ia:principalId ; ia:targetProperty ia:relatedPrincipalId .

ia:IdentityMember a owl:Class ; rdfs:subClassOf ia:Edge ;
    rdfs:label "Identity member" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Links a person (identity) to one of their accounts (principal), from a crawler or from Account Linking." ;
    ia:table "IdentityMembers" ; ia:ingestEntity "identity-members" ;
    ia:sourceProperty ia:identityId ; ia:targetProperty ia:principalId .

ia:ContextMember a owl:Class ; rdfs:subClassOf ia:Edge ;
    rdfs:label "Context member" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Membership of an identity, principal, resource or system in a context. memberType says which table memberId points at." ;
    ia:table "ContextMembers" ; ia:ingestEntity "context-members" ;
    ia:sourceProperty ia:contextId ; ia:targetProperty ia:memberId .

ia:ContextRole a owl:Class ; rdfs:subClassOf ia:Edge ;
    rdfs:label "Context role" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Who answers for a context: one account (principalId) or one person (identityId) — exactly one — is Accountable (at most one per context) or Responsible for it. A context→person link, never access: it is not an assignment and grants nothing." ;
    ia:table "ContextRoles" ; ia:identifierColumn "id" ; ia:identifierSqlType "uuid" ;
    ia:sourceProperty ia:contextId ; ia:targetProperty ia:principalId, ia:identityId .

ia:ContextRelationship a owl:Class ; rdfs:subClassOf ia:Edge ;
    rdfs:label "Context relationship" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A typed link between two contexts: two variants of one unit (its people, its accounts, its resources)." ;
    ia:table "ContextRelationships" ; ia:identifierColumn "id" ; ia:identifierSqlType "uuid" ;
    ia:typeColumn "relationshipType" ;
    ia:sourceProperty ia:contextId ; ia:targetProperty ia:relatedContextId .

# ─── Knowledge: sources and what they claim ──────────────────────────────────
# What someone said, kept apart from what the graph holds. A source makes claims
# about a context or a person; a claim says nothing true until it is confirmed.
# Confirming writes to the graph through its own columns (a description, an
# attribute) or as an ia:ContextRole with the claim as its source — never as a
# way of holding a resource.

ia:Knowledge a owl:Class ;
    rdfs:label "Knowledge" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A table of statements about the graph and where they came from, kept apart from the graph itself: what was said, by whom, when, with the words it rests on." .
ia:Source a owl:Class ; rdfs:subClassOf ia:Knowledge ;
    rdfs:label "Source" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Where claims come from." .
ia:Interview a owl:Class ; rdfs:subClassOf ia:Source ;
    rdfs:label "Interview" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A conversation with one person (the interviewee: an account or a person) about one context — an organizational unit or a logical application — on one date, kept as its transcript. What it says becomes claims." ;
    ia:table "ContextInterviews" ; ia:identifierColumn "id" ; ia:identifierSqlType "uuid" .
ia:Claim a owl:Class ; rdfs:subClassOf ia:Knowledge ;
    rdfs:label "Claim" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A statement an interview makes about a subject — the context itself (subjectKind Context) or a person (Person: the account or person it was matched to, and always the name as spoken) — of one claimKind (description, property, role, roleHistory, membership, alias, activity, expertise, duty), with its value, the period it is about (from / to, or vague text), the verbatim quote it rests on and a confidence. Proposed until someone decides it (claimStatus confirmed, edited or rejected). A confirmed role claim with a roleSuggestion becomes an ia:ContextRole whose sourceClaimId is the claim; a confirmed description or property claim is written to the context. A claim never creates access." ;
    ia:table "ContextClaims" ; ia:identifierColumn "id" ; ia:identifierSqlType "uuid" .
ia:MemberOverride a owl:Class ; rdfs:subClassOf ia:Knowledge ;
    rdfs:label "Member override" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An analyst's decision that a person the member list (its source) still lists is a former member of the context: a contradiction 'left, but still listed' decided 'the interview is right'. It sits on top of ia:ContextMember and never changes it (the source would add the row back): the members list leaves the person out of the current members, the People overview shows them as left (decided) with the decision. One per context and member, with the claim it rests on, the source it overrides, who and when. Undone, it is deleted. It never removes access." ;
    ia:table "ContextMemberOverrides" ; ia:identifierColumn "id" ; ia:identifierSqlType "uuid" .

# ─── Principal types (closed: ingest enum on principalType) ──────────────────
# Three templates say what kind of actor an account is. Who answers for what it
# does is a separate axis (ia:Accountability), a property of each account with a
# default per type.

ia:Person a owl:Class ; rdfs:subClassOf ia:Principal ; ia:template true ;
    rdfs:label "Person" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An account a human uses. The only kind that is linked to an identity and counted in who has access." .
ia:Software a owl:Class ; rdfs:subClassOf ia:Principal ; ia:template true ;
    rdfs:label "Software" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A workload: an application or service with nobody at the keyboard. Never linked to an identity; answered for through an Owner or Sponsor link." .
ia:Agent a owl:Class ; rdfs:subClassOf ia:Principal ; ia:template true ;
    rdfs:label "Agent" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An AI agent that acts with judgement, on one person's behalf, for a team, or on its own permissions. Which of the three is settled per agent (ia:Accountability)." .


ia:User a owl:Class ; rdfs:subClassOf ia:Person ; ia:typeValue "User" ;
    ia:accountabilityDefault ia:Accountability_Personal ;
    ia:emittedBy "azure-rm", "csv", "demo", "entra-id", "midpoint", "mssql", "omada", "scim" ;
    rdfs:label "User" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An interactive human user account." .
ia:ServicePrincipal a owl:Class ; rdfs:subClassOf ia:Software ; ia:typeValue "ServicePrincipal" ;
    ia:accountabilityDefault ia:Accountability_Autonomous ;
    ia:emittedBy "demo", "entra-id", "omada" ;
    rdfs:label "Service principal" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The service principal of an application registration." .
ia:ManagedIdentity a owl:Class ; rdfs:subClassOf ia:Software ; ia:typeValue "ManagedIdentity" ;
    ia:accountabilityDefault ia:Accountability_Autonomous ;
    ia:emittedBy "demo", "entra-id" ;
    rdfs:label "Managed identity" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A system- or user-assigned identity attached to a cloud resource." .
ia:WorkloadIdentity a owl:Class ; rdfs:subClassOf ia:Software ; ia:typeValue "WorkloadIdentity" ;
    ia:accountabilityDefault ia:Accountability_Autonomous ;
    rdfs:label "Workload identity" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A federated-credential identity used by a workload (a pipeline, a Kubernetes service account). Accepted from CSV, SQL, SCIM and midPoint sources; the Entra crawler deliberately does not classify accounts this way." .
# --8<-- [start:ai-agent]
ia:AIAgent a owl:Class ; rdfs:subClassOf ia:Agent ; ia:typeValue "AIAgent" ;
    ia:emittedBy "demo", "entra-id" ;
    rdfs:label "AI agent" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An AI agent (Copilot Studio, Azure OpenAI, a custom bot) that holds access as its own account." .
# --8<-- [end:ai-agent]
ia:ExternalUser a owl:Class ; rdfs:subClassOf ia:Person ; ia:typeValue "ExternalUser" ;
    ia:accountabilityDefault ia:Accountability_Personal ;
    ia:emittedBy "demo", "omada" ;
    rdfs:label "External user" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A guest / B2B account from another organisation." .
ia:SharedMailbox a owl:Class ; rdfs:subClassOf ia:Person ; ia:typeValue "SharedMailbox" ;
    ia:accountabilityDefault ia:Accountability_Shared ;
    ia:emittedBy "demo" ;
    rdfs:label "Shared mailbox" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A shared, room or equipment mailbox account. Accepted from CSV, SQL, SCIM and midPoint sources; of the built-in sources only the demo dataset writes it." .

# ─── Resource types (open vocabulary; these are the built-in ones) ───────────
# Templates: Group, TechnicalRole, Permission (access or control), Application,
# Scope, BusinessRole, Other. A template with one built-in type is that type's
# own class (ia:Group, ia:BusinessRole, ia:Application); the others are
# intermediate classes. How a resource is HELD is never part of this: that is
# ia:AssignmentType, three values, on the assignment.

ia:TechnicalRole a owl:Class ; rdfs:subClassOf ia:Resource ; ia:template true ;
    rdfs:label "Technical role" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A bundle of rights inside one system, as that system defines it, held by an account. A role the business defines is a ia:BusinessRole." .
ia:Permission a owl:Class ; rdfs:subClassOf ia:Resource ; ia:template true ;
    rdfs:label "Permission" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One right. Of the access kind (use something) or the control kind (govern another object). Held Direct, Indirect or Eligible like any resource." .
ia:AccessPermission a owl:Class ; rdfs:subClassOf ia:Permission ;
    rdfs:label "Access permission" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A right to use something: an OAuth scope, an app-only permission, an entitlement in a target application." .
ia:Scope a owl:Class ; rdfs:subClassOf ia:Resource ; ia:template true ;
    rdfs:label "Scope" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A place in a Contains hierarchy (a management group, a subscription, a resource group); a role held at a scope reaches everything below it." .
ia:Other a owl:Class ; rdfs:subClassOf ia:Resource ; ia:template true ;
    rdfs:label "Other" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The fallback for a value a source passes through that its crawler mapping has not placed under a template. No assumptions; no built-in type lands here." .


ia:Group a owl:Class ; rdfs:subClassOf ia:Resource ; ia:typeValue "Group" ;
    ia:template true ; ia:expandsAccess true ;
    ia:emittedBy "demo", "entra-id", "scim" ;
    rdfs:label "Group" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A security or Microsoft 365 group. The effective-access engine expands membership through it." .
ia:EntraDirectoryRole a owl:Class ; rdfs:subClassOf ia:TechnicalRole ; ia:typeValue "EntraDirectoryRole" ;
    ia:emittedBy "demo", "entra-id" ;
    rdfs:label "Entra directory role" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One Entra directory role (id = roleDefinitionId); extendedAttributes holds its allowedResourceActions." .
ia:BusinessRole a owl:Class ; rdfs:subClassOf ia:Resource ; ia:typeValue "BusinessRole" ;
    ia:template true ;
    ia:emittedBy "csv", "demo", "entra-id", "midpoint", "mssql", "omada" ;
    rdfs:label "Business role" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A governance construct (Entra access package, Omada / midPoint business role). Contains the resources it grants; hidden from the matrix by default." .
ia:Application a owl:Class ; rdfs:subClassOf ia:Resource ; ia:typeValue "Application" ;
    ia:template true ;
    ia:emittedBy "demo", "entra-id" ;
    rdfs:label "Application" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An enterprise application (service principal) as a resource. Grants nothing by itself; parent of its app roles and permissions." .
ia:AppRegistration a owl:Class ; rdfs:subClassOf ia:Application ; ia:typeValue "AppRegistration" ;
    ia:emittedBy "entra-id" ;
    rdfs:label "App registration" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An app registration (id = application object id; appId joins it to its service principal). Grants nothing and has no assignments; carries the app's security set-up (credential metadata, redirect URIs, required resource access, federated credentials)." .
ia:AppRole a owl:Class ; rdfs:subClassOf ia:TechnicalRole ; ia:typeValue "AppRole" ;
    ia:emittedBy "demo", "entra-id" ;
    rdfs:label "App role" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One app role of an application (one resource per application + appRoleId)." .
ia:DelegatedPermission a owl:Class ; rdfs:subClassOf ia:AccessPermission ; ia:typeValue "DelegatedPermission" ;
    ia:emittedBy "demo", "entra-id" ;
    rdfs:label "Delegated permission" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One OAuth2 delegated scope granted to a client application on an API (one resource per client, API and scope)." .
ia:ApplicationPermission a owl:Class ; rdfs:subClassOf ia:AccessPermission ; ia:typeValue "ApplicationPermission" ;
    ia:emittedBy "entra-id" ;
    rdfs:label "Application permission" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One app-only (admin-consented) permission a service principal holds on another API." .
ia:ControlPermission a owl:Class ; rdfs:subClassOf ia:Permission ; ia:expandsAccess false ;
    rdfs:label "Control permission" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A right over another object: owning it, administering it. The object is named by a relationship from it to this resource (hasOwnership, hasAppOwnership), so owner and member of a group refer to the same group. Holding a control permission never makes the holder a member of what it controls. Each type is one resource per controlled object, named after it, held through a Direct assignment. The list is app/api/src/lib/ownershipTypes.js." .
ia:GroupOwnership a owl:Class ; rdfs:subClassOf ia:ControlPermission ; ia:typeValue "GroupOwnership" ;
    ia:emittedBy "demo", "entra-id" ;
    rdfs:label "Group ownership" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The owners of an Entra group." .
ia:ServicePrincipalOwnership a owl:Class ; rdfs:subClassOf ia:ControlPermission ; ia:typeValue "ServicePrincipalOwnership" ;
    ia:emittedBy "demo", "entra-id" ;
    rdfs:label "Service principal ownership" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The owners of an enterprise application's service principal." .
ia:ApplicationOwnership a owl:Class ; rdfs:subClassOf ia:ControlPermission ; ia:typeValue "ApplicationOwnership" ;
    ia:emittedBy "demo", "entra-id" ;
    rdfs:label "Application ownership" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The owners of an app registration — they can add a credential and act as the app." .
ia:ResourceOwnership a owl:Class ; rdfs:subClassOf ia:ControlPermission ; ia:typeValue "ResourceOwnership" ;
    ia:emittedBy "mssql" ;
    rdfs:label "Resource ownership" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The owners of a resource loaded by the SQL connector; the owned resource's own type is in extendedAttributes.ownedResourceType." .

# Resource types that crawlers write (ia:emittedBy = the crawler's manifest type).
ia:AzureScope a owl:Class ; rdfs:subClassOf ia:Scope ; ia:typeValue "AzureScope" ;
    ia:emittedBy "azure-rm", "demo" ;
    rdfs:label "Azure scope" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The tenant root scope ('/') of Azure Resource Manager, above every management group." .
ia:AzureManagementGroup a owl:Class ; rdfs:subClassOf ia:Scope ; ia:typeValue "AzureManagementGroup" ;
    ia:emittedBy "azure-rm" ;
    rdfs:label "Azure management group" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An Azure management group; Contains the management groups and subscriptions below it." .
ia:AzureSubscription a owl:Class ; rdfs:subClassOf ia:Scope ; ia:typeValue "AzureSubscription" ;
    ia:emittedBy "azure-rm" ;
    rdfs:label "Azure subscription" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An Azure subscription; Contains its resource groups." .
ia:AzureResourceGroup a owl:Class ; rdfs:subClassOf ia:Scope ; ia:typeValue "AzureResourceGroup" ;
    ia:emittedBy "azure-rm", "demo" ;
    rdfs:label "Azure resource group" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An Azure resource group; Contains its resources." .
ia:AzureResource a owl:Class ; rdfs:subClassOf ia:Scope ; ia:typeValue "AzureResource" ;
    ia:emittedBy "azure-rm", "demo" ;
    rdfs:label "Azure resource" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One Azure resource. Its ARM type (Microsoft.Compute/virtualMachines …) is in extendedAttributes.azureResourceType, not in resourceType." .
ia:AzureRoleAssignment a owl:Class ; rdfs:subClassOf ia:TechnicalRole ; ia:typeValue "AzureRoleAssignment" ;
    ia:emittedBy "azure-rm", "demo" ;
    rdfs:label "Azure role at a scope" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One Azure RBAC role at one scope (role definition + scope); holders have it Direct, or Indirect through a group or an inherited scope." .
ia:Service a owl:Class ; rdfs:subClassOf ia:Application ; ia:typeValue "Service" ;
    ia:emittedBy "midpoint" ;
    rdfs:label "Service" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A service (an application or system) as midPoint models it." .
ia:Entitlement a owl:Class ; rdfs:subClassOf ia:AccessPermission ; ia:typeValue "Entitlement" ;
    ia:emittedBy "midpoint", "mssql" ;
    rdfs:label "Entitlement" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A permission in a target application, as an IGA system records it (a midPoint entitlement shadow, an IdentityIQ entitlement)." .
ia:UntypedResource a owl:Class ; rdfs:subClassOf ia:AccessPermission ; ia:typeValue "Resource" ;
    ia:emittedBy "omada" ;
    rdfs:label "Resource (no finer type)" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A resource the source does not classify further. Omada's default for permissions; the source's own type is in extendedAttributes.resourceType." .
ia:SAPRole a owl:Class ; rdfs:subClassOf ia:TechnicalRole ; ia:typeValue "SAPRole" ;
    ia:emittedBy "demo" ;
    rdfs:label "SAP role" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An SAP role. Only the demo dataset emits it; a real SAP source would arrive through CSV or SQL with a value of its own choosing." .
ia:CRMRole a owl:Class ; rdfs:subClassOf ia:TechnicalRole ; ia:typeValue "CRMRole" ;
    ia:emittedBy "demo" ;
    rdfs:label "CRM role" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A role in a CRM system. Only the demo dataset emits it." .

# ─── Closed value lists ───────────────────────────────────────────────────────

# --8<-- [start:assignment-type]
ia:AssignmentType a owl:Class ;
    rdfs:label "Assignment type" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "How an assignment is held. Only these three values exist; ownership, governance and source detail are modelled elsewhere." .
ia:AssignmentType_Direct a owl:NamedIndividual, ia:AssignmentType ; ia:typeValue "Direct" ;
    rdfs:label "Direct" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Held directly: a membership, a directly assigned app role, an OAuth2 grant, an ownership." .
ia:AssignmentType_Indirect a owl:NamedIndividual, ia:AssignmentType ; ia:typeValue "Indirect" ;
    rdfs:label "Indirect" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Inherited through another resource (an app role held via a group, a nested group). Stored, not inferred." .
ia:AssignmentType_Eligible a owl:NamedIndividual, ia:AssignmentType ; ia:typeValue "Eligible" ;
    rdfs:label "Eligible" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Granted but not active (PIM-eligible): can be activated." .
# --8<-- [end:assignment-type]

ia:AssignmentOrigin a owl:Class ;
    rdfs:label "Assignment origin" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Where an assignment came from, as the source records it. Optional." .
ia:AssignmentOrigin_Automatic a owl:NamedIndividual, ia:AssignmentOrigin ; ia:typeValue "Automatic" ;
    rdfs:label "Automatic" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Assigned by a rule or birthright policy." .
ia:AssignmentOrigin_Requested a owl:NamedIndividual, ia:AssignmentOrigin ; ia:typeValue "Requested" ;
    rdfs:label "Requested" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Assigned through an access request." .
ia:AssignmentOrigin_Discovered a owl:NamedIndividual, ia:AssignmentOrigin ; ia:typeValue "Discovered" ;
    rdfs:label "Discovered" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Found on the target system without a recorded reason." .

ia:AssignmentEffect a owl:Class ;
    rdfs:label "Assignment effect" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What an assignment does to effective access (read by the effective-access engine)." .
ia:AssignmentEffect_allow a owl:NamedIndividual, ia:AssignmentEffect ; ia:typeValue "allow" ;
    rdfs:label "allow" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A concrete grant." .
ia:AssignmentEffect_deny a owl:NamedIndividual, ia:AssignmentEffect ; ia:typeValue "deny" ;
    rdfs:label "deny" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An explicit deny." .
ia:AssignmentEffect_eligible a owl:NamedIndividual, ia:AssignmentEffect ; ia:typeValue "eligible" ;
    rdfs:label "eligible" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Potential access only; excluded from effective answers." .
ia:AssignmentEffect_notset a owl:NamedIndividual, ia:AssignmentEffect ; ia:typeValue "notset" ;
    rdfs:label "notset" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Neither grants nor denies." .

ia:PropagationScope a owl:Class ;
    rdfs:label "Propagation scope" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Where along a containment hierarchy an assignment applies." .
ia:PropagationScope_self a owl:NamedIndividual, ia:PropagationScope ; ia:typeValue "self" ;
    rdfs:label "self" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Only at the assigned resource." .
ia:PropagationScope_descendants a owl:NamedIndividual, ia:PropagationScope ; ia:typeValue "descendants" ;
    rdfs:label "descendants" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Only below the assigned resource." .
ia:PropagationScope_selfAndDescendants a owl:NamedIndividual, ia:PropagationScope ; ia:typeValue "selfAndDescendants" ;
    rdfs:label "selfAndDescendants" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "At the assigned resource and everything below it (the default)." .

ia:ContextVariant a owl:Class ;
    rdfs:label "Context variant" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "How a context came to exist." .
ia:ContextVariant_synced a owl:NamedIndividual, ia:ContextVariant ; ia:typeValue "synced" ;
    rdfs:label "synced" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Ingested from a source system." .
ia:ContextVariant_generated a owl:NamedIndividual, ia:ContextVariant ; ia:typeValue "generated" ;
    rdfs:label "generated" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Emitted by a context-algorithm plugin." .
ia:ContextVariant_manual a owl:NamedIndividual, ia:ContextVariant ; ia:typeValue "manual" ;
    rdfs:label "manual" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Curated by an analyst (tags included)." .

ia:Accountability a owl:Class ;
    rdfs:label "Accountability" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Who answers for what an account does. A property of each account, with a default per principal type (ia:accountabilityDefault). Declared ahead of its column." .
ia:Accountability_Personal a owl:NamedIndividual, ia:Accountability ; ia:typeValue "Personal" ;
    rdfs:label "Personal" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One person answers for it: their own account, or an agent acting with their delegated rights (linked to them by an Owner relationship)." .
ia:Accountability_Shared a owl:NamedIndividual, ia:Accountability ; ia:typeValue "Shared" ;
    rdfs:label "Shared" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A team answers for it; several people use it. Needs an owner." .
ia:Accountability_Autonomous a owl:NamedIndividual, ia:Accountability ; ia:typeValue "Autonomous" ;
    rdfs:label "Autonomous" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Acts on its own permissions; answered for through an Owner or Sponsor link." .

ia:ContextCategory a owl:Class ;
    rdfs:label "Context category" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The template a context falls under, stored per row (Contexts.contextCategory). Each value denotes the ia:template class of that name." .
ia:ContextCategory_OrganizationalUnit a owl:NamedIndividual, ia:ContextCategory ; ia:typeValue "OrganizationalUnit" ; ia:denotesTemplate ia:OrganizationalUnit ;
    rdfs:label "OrganizationalUnit" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Organisation structure." .
ia:ContextCategory_LogicalApplication a owl:NamedIndividual, ia:ContextCategory ; ia:typeValue "LogicalApplication" ; ia:denotesTemplate ia:LogicalApplicationContext ;
    rdfs:label "LogicalApplication" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An application as the business knows it." .
ia:ContextCategory_Tag a owl:NamedIndividual, ia:ContextCategory ; ia:typeValue "Tag" ; ia:denotesTemplate ia:TagContext ;
    rdfs:label "Tag" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A manual label." .
ia:ContextCategory_Segment a owl:NamedIndividual, ia:ContextCategory ; ia:typeValue "Segment" ; ia:denotesTemplate ia:Segment ;
    rdfs:label "Segment" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A grouping by an attribute or an analysis." .

ia:ContextRoleType a owl:Class ;
    rdfs:label "Context role" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What a person is to a context. Only an OrganizationalUnit or a LogicalApplication carries roles." .
ia:ContextRoleType_Accountable a owl:NamedIndividual, ia:ContextRoleType ; ia:typeValue "Accountable" ;
    rdfs:label "Accountable" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Answers for the unit or application: its manager or owner. At most one per context." .
ia:ContextRoleType_Responsible a owl:NamedIndividual, ia:ContextRoleType ; ia:typeValue "Responsible" ;
    rdfs:label "Responsible" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Does the work the accountable person delegated. Any number per context." .

ia:ExtractionStatus a owl:Class ;
    rdfs:label "Extraction status" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "How far reading an interview with the local model got." .
ia:ExtractionStatus_pending a owl:NamedIndividual, ia:ExtractionStatus ; ia:typeValue "pending" ;
    rdfs:label "pending" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Waiting to be read." .
ia:ExtractionStatus_running a owl:NamedIndividual, ia:ExtractionStatus ; ia:typeValue "running" ;
    rdfs:label "running" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Being read." .
ia:ExtractionStatus_done a owl:NamedIndividual, ia:ExtractionStatus ; ia:typeValue "done" ;
    rdfs:label "done" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Read; its claims wait for review." .
ia:ExtractionStatus_failed a owl:NamedIndividual, ia:ExtractionStatus ; ia:typeValue "failed" ;
    rdfs:label "failed" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Reading failed; the message says why. It can be retried." .
ia:ExtractionStatus_notConfigured a owl:NamedIndividual, ia:ExtractionStatus ; ia:typeValue "notConfigured" ;
    rdfs:label "notConfigured" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "No local model is configured; claims are added by hand." .

ia:ClaimKind a owl:Class ;
    rdfs:label "Claim kind" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What a claim states." .
ia:ClaimKind_description a owl:NamedIndividual, ia:ClaimKind ; ia:typeValue "description" ;
    rdfs:label "description" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What the context is, in words. Confirmed, it is added to the description." .
ia:ClaimKind_property a owl:NamedIndividual, ia:ClaimKind ; ia:typeValue "property" ;
    rdfs:label "property" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One fact about the context, under an attribute name. Confirmed, it sets that extended attribute." .
ia:ClaimKind_role a owl:NamedIndividual, ia:ClaimKind ; ia:typeValue "role" ;
    rdfs:label "role" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What a person is to the context (the relation as said: owner, notOwner, dayToDay, delegate, member, other). With a roleSuggestion, confirmed, it becomes a ContextRole." .
ia:ClaimKind_roleHistory a owl:NamedIndividual, ia:ClaimKind ; ia:typeValue "roleHistory" ;
    rdfs:label "roleHistory" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A role a person held at the context over a period. Knowledge only." .
ia:ClaimKind_membership a owl:NamedIndividual, ia:ClaimKind ; ia:typeValue "membership" ;
    rdfs:label "membership" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Whether a person is in the context: the status (current, former, joined, left, rejoined) in attribute, with the period. Knowledge only: confirming it never changes the context's members, which come from their source." .
ia:ClaimKind_alias a owl:NamedIndividual, ia:ClaimKind ; ia:typeValue "alias" ;
    rdfs:label "alias" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Another name the context goes by. Confirmed, it is added to the context's extendedAttributes.aliases." .
ia:ClaimKind_activity a owl:NamedIndividual, ia:ClaimKind ; ia:typeValue "activity" ;
    rdfs:label "activity" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "performsActivity: a person performs a business activity (value: its name). Confirmed, the claim names its object, an ia:ActivityContext (objectContextId). Knowledge only: it informs role engineering and never grants access." .
ia:ClaimKind_expertise a owl:NamedIndividual, ia:ClaimKind ; ia:typeValue "expertise" ;
    rdfs:label "expertise" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "hasExpertise: a person has knowledge of a domain (value: its name). Confirmed, the claim names its object, an ia:ExpertiseContext. Knowledge only." .
ia:ClaimKind_duty a owl:NamedIndividual, ia:ClaimKind ; ia:typeValue "duty" ;
    rdfs:label "duty" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "holdsResponsibility: a person holds a duty outside or across their daily work — works council, fire warden, a project role (value: its name). Called duty so it is never read as the ContextRole Responsible. Confirmed, the claim names its object, an ia:DutyContext. Knowledge only." .

ia:ClaimSubjectKind a owl:Class ;
    rdfs:label "Claim subject" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What a claim is about." .
ia:ClaimSubjectKind_Context a owl:NamedIndividual, ia:ClaimSubjectKind ; ia:typeValue "Context" ;
    rdfs:label "Context" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The context the interview is about." .
ia:ClaimSubjectKind_Person a owl:NamedIndividual, ia:ClaimSubjectKind ; ia:typeValue "Person" ;
    rdfs:label "Person" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A person named in the interview." .

ia:SubjectMatch a owl:Class ;
    rdfs:label "Subject match" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "How the person a claim names was matched to an account or a person." .
ia:SubjectMatch_interviewee a owl:NamedIndividual, ia:SubjectMatch ; ia:typeValue "interviewee" ;
    rdfs:label "interviewee" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The interviewee, speaking about themselves." .
ia:SubjectMatch_key a owl:NamedIndividual, ia:SubjectMatch ; ia:typeValue "key" ;
    rdfs:label "key" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "By an identifier (e-mail, employee id, external id), or chosen by an analyst." .
ia:SubjectMatch_name a owl:NamedIndividual, ia:SubjectMatch ; ia:typeValue "name" ;
    rdfs:label "name" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "By the normalised name, the one candidate with it." .
ia:SubjectMatch_fuzzy a owl:NamedIndividual, ia:SubjectMatch ; ia:typeValue "fuzzy" ;
    rdfs:label "fuzzy" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "By a near miss of the name. To be checked." .
ia:SubjectMatch_firstName a owl:NamedIndividual, ia:SubjectMatch ; ia:typeValue "firstName" ;
    rdfs:label "firstName" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "By a first name alone, the one person the context knows with it. To be checked." .

ia:ClaimStatus a owl:Class ;
    rdfs:label "Claim status" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Where a claim stands in review." .
ia:ClaimStatus_proposed a owl:NamedIndividual, ia:ClaimStatus ; ia:typeValue "proposed" ;
    rdfs:label "proposed" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Not decided yet." .
ia:ClaimStatus_confirmed a owl:NamedIndividual, ia:ClaimStatus ; ia:typeValue "confirmed" ;
    rdfs:label "confirmed" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Confirmed as said." .
ia:ClaimStatus_edited a owl:NamedIndividual, ia:ClaimStatus ; ia:typeValue "edited" ;
    rdfs:label "edited" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Confirmed with a changed value or period." .
ia:ClaimStatus_rejected a owl:NamedIndividual, ia:ClaimStatus ; ia:typeValue "rejected" ;
    rdfs:label "rejected" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Rejected." .

ia:ClaimRelevance a owl:Class ;
    rdfs:label "Claim relevance" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "How much a claim matters for identity and access governance." .
ia:ClaimRelevance_high a owl:NamedIndividual, ia:ClaimRelevance ; ia:typeValue "high" ;
    rdfs:label "high" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Matters for who should have access to what: people, roles, membership, aliases, facts that affect access." .
ia:ClaimRelevance_low a owl:NamedIndividual, ia:ClaimRelevance ; ia:typeValue "low" ;
    rdfs:label "low" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "True, but changes nothing about access. Folded away in review." .

ia:ClaimProposer a owl:Class ;
    rdfs:label "Claim proposer" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Who proposed a claim." .
ia:ClaimProposer_model a owl:NamedIndividual, ia:ClaimProposer ; ia:typeValue "model" ;
    rdfs:label "model" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The local model, reading the transcript." .
ia:ClaimProposer_analyst a owl:NamedIndividual, ia:ClaimProposer ; ia:typeValue "analyst" ;
    rdfs:label "analyst" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An analyst, by hand." .

ia:EntityKind a owl:Class ;
    rdfs:label "Entity kind" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The kind of node a context groups (targetType) or a context member is (memberType)." .
ia:EntityKind_Identity a owl:NamedIndividual, ia:EntityKind ; ia:typeValue "Identity" ; ia:denotesClass ia:Identity ;
    rdfs:label "Identity" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Members are identities." .
ia:EntityKind_Resource a owl:NamedIndividual, ia:EntityKind ; ia:typeValue "Resource" ; ia:denotesClass ia:Resource ;
    rdfs:label "Resource" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Members are resources." .
ia:EntityKind_Principal a owl:NamedIndividual, ia:EntityKind ; ia:typeValue "Principal" ; ia:denotesClass ia:Principal ;
    rdfs:label "Principal" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Members are principals." .
ia:EntityKind_System a owl:NamedIndividual, ia:EntityKind ; ia:typeValue "System" ; ia:denotesClass ia:System ;
    rdfs:label "System" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Members are systems. Note: memberId is a uuid and Systems.id an integer, so a System member row cannot reference a system by id." .

ia:MembershipSource a owl:Class ;
    rdfs:label "Membership source" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Who put a member into a context." .
ia:MembershipSource_sync a owl:NamedIndividual, ia:MembershipSource ; ia:typeValue "sync" ;
    rdfs:label "sync" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A crawler." .
ia:MembershipSource_algorithm a owl:NamedIndividual, ia:MembershipSource ; ia:typeValue "algorithm" ;
    rdfs:label "algorithm" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A context-algorithm plugin." .
ia:MembershipSource_analyst a owl:NamedIndividual, ia:MembershipSource ; ia:typeValue "analyst" ;
    rdfs:label "analyst" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An analyst, by hand." .
ia:MembershipSource_sourceOwner a owl:NamedIndividual, ia:MembershipSource ; ia:typeValue "sourceOwner" ;
    rdfs:label "sourceOwner" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The owner a synced context's source names (ownerUserId), stated as its Accountable by the contexts ingest and kept in step on every sync. Only the ingest writes it, and it replaces or removes only these rows." .

# ─── Context types (open vocabulary; the ones the application itself knows) ───
# Templates: OrganizationalUnit, LogicalApplication, Tag, Segment, stored per row
# in contextCategory. The two with one built-in type are that type's own class
# (ia:LogicalApplicationContext, ia:TagContext). A tree's root is a context
# without a parent, not a type of its own; the tags root is a Tag with
# extendedAttributes.tagRoot.

ia:OrganizationalUnit a owl:Class ; rdfs:subClassOf ia:Context ; ia:template true ;
    rdfs:label "Organizational unit" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Organisation structure: a department, a team, a manager's reports, an OU, a cost center, a project or a program. Groups persons or their accounts, or the resources that belong to such a unit — each a separate context, linked as variants by sameUnitAs; may form a tree; may carry an Accountable and Responsible (ContextRoles); the entry point for manager-led role mining." .
ia:Segment a owl:Class ; rdfs:subClassOf ia:Context ; ia:template true ;
    rdfs:label "Segment" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A grouping by a shared attribute or an analysis (by type, by system, risky consent, a cluster, a recipe). Membership is computed and read-only; no manager, no moving." .

# A crawler or an analyst may store any contextType (Omada's OrgUnit, a SQL
# source's LogicalApplication …). Defined here are the values the code gives a
# meaning to: what each context-algorithm plugin emits (ia:producedBy = the
# plugin's name, checked against its `contextTypes`) and what routes and screens
# compare against. ia:allowedTargetType: the kind of entity such a context groups.

# --8<-- [start:manager-hierarchy]
ia:ManagerHierarchyContext a owl:Class ; rdfs:subClassOf ia:OrganizationalUnit ; ia:typeValue "ManagerHierarchy" ;
    ia:producedBy "manager-hierarchy" ; ia:allowedTargetType ia:EntityKind_Principal ;
    rdfs:label "Manager hierarchy node" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One generated context per manager of one system's accounts, plus a synthetic root (externalId 'root'). The manager is recorded only in externalId, which holds the manager's Principal id — there is no manager column or member role. Members are the manager's direct reports (Principals.managerId, overridden per account by ManagerHierarchyOverrides); the manager is a member of their own manager's node, not of their own. parentContextId is the node of the manager's own manager, else the root. Accounts with no manager that manage nobody are members of the root; a top-level manager is a member of no node. A managerId that points at no account of the system still becomes a node, named 'Unknown'. A reporting cycle, a self-reference included, leaves a node without a parent: the runner refuses the link that would close the cycle." .
# --8<-- [end:manager-hierarchy]
ia:OrganisationalUnitContext a owl:Class ; rdfs:subClassOf ia:OrganizationalUnit ; ia:typeValue "OrganisationalUnit" ;
    ia:producedBy "ad-ou-from-dn" ; ia:allowedTargetType ia:EntityKind_Principal ;
    rdfs:label "Organisational unit (from DN)" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An Active Directory OU derived from the accounts' distinguished names, nested like the directory. Crawlers that sync org units (Omada, CSV, midPoint) store 'OrgUnit' instead — a different value the ontology does not define." .
ia:DepartmentContext a owl:Class ; rdfs:subClassOf ia:OrganizationalUnit ; ia:typeValue "Department" ;
    ia:emittedBy "demo", "omada" ;
    ia:producedBy "department-from-principal" ; ia:allowedTargetType ia:EntityKind_Identity, ia:EntityKind_Principal ;
    rdfs:label "Department" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One flat context per distinct Principals.department value (externalId 'dept:<value>'), without hierarchy. The Omada crawler syncs departments of persons under the same value, and the demo dataset writes a department tree of accounts." .
ia:OrphanedAccountsContext a owl:Class ; rdfs:subClassOf ia:Segment ; ia:typeValue "OrphanedAccounts" ;
    ia:producedBy "orphaned-accounts" ; ia:allowedTargetType ia:EntityKind_Principal ;
    rdfs:label "Orphaned accounts" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Accounts that are not linked to any identity." .
ia:PrincipalTypeContext a owl:Class ; rdfs:subClassOf ia:Segment ; ia:typeValue "PrincipalType" ;
    ia:producedBy "principal-type-tree" ; ia:allowedTargetType ia:EntityKind_Principal ;
    rdfs:label "Principal type group" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The accounts of one principalType." .
ia:ResourceTypeContext a owl:Class ; rdfs:subClassOf ia:Segment ; ia:typeValue "ResourceType" ;
    ia:producedBy "resource-type-tree" ; ia:allowedTargetType ia:EntityKind_Resource ;
    rdfs:label "Resource type group" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The resources of one resourceType." .
ia:ResourcePlaneContext a owl:Class ; rdfs:subClassOf ia:Segment ; ia:typeValue "ResourcePlane" ;
    ia:producedBy "resource-type-tree" ; ia:allowedTargetType ia:EntityKind_Resource ;
    rdfs:label "Resource plane" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Control or data plane below a resource type group." .
ia:ResourceRoleContext a owl:Class ; rdfs:subClassOf ia:Segment ; ia:typeValue "ResourceRole" ;
    ia:producedBy "resource-type-tree" ; ia:allowedTargetType ia:EntityKind_Resource ;
    rdfs:label "Resource role group" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One role name below a resource plane." .
ia:ScopeContext a owl:Class ; rdfs:subClassOf ia:Segment ; ia:typeValue "Scope" ;
    ia:producedBy "scope-hierarchy" ; ia:allowedTargetType ia:EntityKind_Resource ;
    rdfs:label "Scope" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A node of the scope-hierarchy tree, the root included: one Azure scope (management group, subscription, resource group). The resource's own type is in extendedAttributes.resourceType." .
ia:EntraGroupCategoryContext a owl:Class ; rdfs:subClassOf ia:Segment ; ia:typeValue "EntraGroupCategory" ;
    ia:producedBy "entra-group-category-tree" ; ia:allowedTargetType ia:EntityKind_Resource ;
    rdfs:label "Entra group category" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The Entra groups of one category (security, Microsoft 365, dynamic …)." .
ia:RiskyConsentContext a owl:Class ; rdfs:subClassOf ia:Segment ; ia:typeValue "RiskyConsent" ;
    ia:producedBy "risky-consent" ; ia:allowedTargetType ia:EntityKind_Resource ;
    rdfs:label "Risky consent tier" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Granted permissions of one risk tier (High, Medium, Low)." .
ia:RiskyAppConsentContext a owl:Class ; rdfs:subClassOf ia:Segment ; ia:typeValue "RiskyAppConsent" ;
    ia:producedBy "risky-consent" ; ia:allowedTargetType ia:EntityKind_Resource ;
    rdfs:label "Risky app consent" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Applications flagged as malicious (threat feed) or suspicious (heuristics)." .
ia:SystemMembershipContext a owl:Class ; rdfs:subClassOf ia:Segment ; ia:typeValue "SystemMembership" ;
    ia:producedBy "system-membership-principals", "system-membership-resources" ;
    ia:allowedTargetType ia:EntityKind_Principal, ia:EntityKind_Resource ;
    rdfs:label "Objects of one system" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The accounts, or the resources, loaded from one system." .
ia:ResourceClusterContext a owl:Class ; rdfs:subClassOf ia:Segment ; ia:typeValue "ResourceCluster" ;
    ia:producedBy "resource-cluster" ; ia:allowedTargetType ia:EntityKind_Resource ;
    rdfs:label "Resource cluster" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Resources whose names cluster together." .
ia:ContextRecipeContext a owl:Class ; rdfs:subClassOf ia:LogicalApplicationContext ; ia:typeValue "ContextRecipe" ;
    ia:producedBy "context-recipe" ; ia:allowedTargetType ia:EntityKind_Resource ;
    rdfs:label "Context recipe result" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Resources matched by a recipe built in the context assistant, plus the ones pinned by hand. The type says how the context was built; its template (contextCategory) is chosen at save time, an application being the common case." .
ia:TagContext a owl:Class ; rdfs:subClassOf ia:Context ; ia:typeValue "Tag" ;
    ia:template true ;
    ia:allowedTargetType ia:EntityKind_Principal, ia:EntityKind_Resource, ia:EntityKind_Identity ;
    rdfs:label "Tag" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A manual label (variant 'manual') that the tags API reads and writes. One root per targetType holds them, itself a Tag marked extendedAttributes.tagRoot = true, which the tags API and the GraphTags view leave out." .
ia:ActivityContext a owl:Class ; rdfs:subClassOf ia:TagContext ; ia:typeValue "Activity" ;
    ia:allowedTargetType ia:EntityKind_Identity ;
    rdfs:label "Activity" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A business activity people perform (performsActivity), the object of an activity claim. Manual, under one root Activities (extendedAttributes.knowledgeRoot); created when a claim naming it is confirmed (Authorization workbench)." .
ia:ExpertiseContext a owl:Class ; rdfs:subClassOf ia:TagContext ; ia:typeValue "Expertise" ;
    ia:allowedTargetType ia:EntityKind_Identity ;
    rdfs:label "Expertise" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A domain people know (hasExpertise), the object of an expertise claim. Manual, under one root Expertise." .
ia:DutyContext a owl:Class ; rdfs:subClassOf ia:TagContext ; ia:typeValue "Duty" ;
    ia:allowedTargetType ia:EntityKind_Identity ;
    rdfs:label "Duty" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A duty people hold beside their daily work (holdsResponsibility: works council, fire warden, a project role), the object of a duty claim. Manual, under one root Duties." .

# Context types that crawlers write (ia:emittedBy = the crawler's manifest type).
ia:OrgUnitContext a owl:Class ; rdfs:subClassOf ia:OrganizationalUnit ; ia:typeValue "OrgUnit" ;
    ia:emittedBy "csv", "midpoint", "omada" ;
    ia:allowedTargetType ia:EntityKind_Identity ;
    rdfs:label "Org unit" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An organisational unit synced from an IGA or HR source, grouping persons; nested like the source's org tree. The default context type of the Omada, CSV and midPoint crawlers. Not the same value as the OrganisationalUnit the ad-ou-from-dn plugin derives from accounts." .
ia:LocationContext a owl:Class ; rdfs:subClassOf ia:Segment ; ia:typeValue "Location" ;
    ia:emittedBy "omada" ;
    ia:allowedTargetType ia:EntityKind_Identity ;
    rdfs:label "Location" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A work location synced from Omada, grouping persons." .
ia:CostCenterContext a owl:Class ; rdfs:subClassOf ia:OrganizationalUnit ; ia:typeValue "CostCenter" ;
    ia:emittedBy "omada" ;
    ia:allowedTargetType ia:EntityKind_Identity ;
    rdfs:label "Cost center" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A cost center synced from Omada, grouping persons: an org dimension a manager recognises, so an organizational unit." .
ia:LogicalApplicationContext a owl:Class ; rdfs:subClassOf ia:Context ; ia:typeValue "LogicalApplication" ;
    ia:template true ;
    ia:emittedBy "demo", "mssql" ;
    ia:allowedTargetType ia:EntityKind_Resource ;
    rdfs:label "Logical application" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An application as the business knows it, grouping the technical resources (entitlements, roles, groups) that belong to it. The SQL connector's IdentityIQ preset loads these from the application list." .
ia:TeamContext a owl:Class ; rdfs:subClassOf ia:OrganizationalUnit ; ia:typeValue "Team" ;
    ia:emittedBy "demo" ;
    ia:allowedTargetType ia:EntityKind_Principal, ia:EntityKind_Resource ;
    rdfs:label "Team" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A team below a department, as its people or as the resources it administers (the two linked by sameUnitAs). Only the demo dataset emits it." .
ia:AdministrativeUnitContext a owl:Class ; rdfs:subClassOf ia:OrganizationalUnit ; ia:typeValue "AdministrativeUnit" ;
    ia:emittedBy "demo" ;
    ia:allowedTargetType ia:EntityKind_Principal ;
    rdfs:label "Administrative unit" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An Entra administrative unit. Only the demo dataset emits it; the Entra crawler does not sync administrative units." .

# ─── Relationship types (ResourceRelationships.relationshipType) ─────────────

ia:contains a owl:ObjectProperty ; ia:typeValue "Contains" ; ia:storedIn ia:ResourceRelationship ;
    rdfs:domain ia:Resource ; rdfs:range ia:Resource ;
    rdfs:label "contains" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The child is part of the parent: a business role's granted resources, a scope inside a scope. Holding the parent reaches the child." .
ia:grantsAccessTo a owl:ObjectProperty ; ia:typeValue "GrantsAccessTo" ; ia:storedIn ia:ResourceRelationship ;
    rdfs:domain ia:Resource ; rdfs:range ia:Resource ;
    rdfs:label "grants access to" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Holding the parent implies access to the child. Emitted by the CSV and SQL connectors and the demo dataset; no built-in crawler uses it." .
# --8<-- [start:has-app-role]
ia:hasAppRole a owl:ObjectProperty ; ia:typeValue "HasAppRole" ; ia:storedIn ia:ResourceRelationship ;
    rdfs:domain ia:Application ; rdfs:range ia:AppRole ;
    rdfs:label "has app role" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An application and one of its app roles." .
# --8<-- [end:has-app-role]
ia:delegatesScope a owl:ObjectProperty ; ia:typeValue "DelegatesScope" ; ia:storedIn ia:ResourceRelationship ;
    rdfs:domain ia:Application ; rdfs:range ia:DelegatedPermission ;
    rdfs:label "delegates scope" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A client application and a delegated permission it was granted." .
ia:hasApplicationPermission a owl:ObjectProperty ; ia:typeValue "HasApplicationPermission" ; ia:storedIn ia:ResourceRelationship ;
    rdfs:domain ia:Application ; rdfs:range ia:ApplicationPermission ;
    rdfs:label "has application permission" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A client application and an app-only permission it holds." .
ia:hasOwnership a owl:ObjectProperty ; ia:typeValue "HasOwnership" ; ia:storedIn ia:ResourceRelationship ;
    rdfs:domain ia:Resource ; rdfs:range [ a owl:Class ; owl:unionOf ( ia:GroupOwnership ia:ResourceOwnership ) ] ;
    rdfs:label "has ownership" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An owned resource and the ownership resource whose holders are its owners (Entra groups, SQL-connector resources)." .
ia:hasAppOwnership a owl:ObjectProperty ; ia:typeValue "HasAppOwnership" ; ia:storedIn ia:ResourceRelationship ;
    rdfs:domain ia:Application ; rdfs:range [ a owl:Class ; owl:unionOf ( ia:ServicePrincipalOwnership ia:ApplicationOwnership ) ] ;
    rdfs:label "has app ownership" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Same meaning as hasOwnership, for applications. A separate value only so the group-owner full sync cannot reconcile app-owner links away." .

# ─── Relationship types (ContextRelationships.relationshipType) ──────────────

ia:sameUnitAs a owl:ObjectProperty, owl:SymmetricProperty ; ia:typeValue "SameUnitAs" ; ia:storedIn ia:ContextRelationship ;
    rdfs:domain ia:Context ; rdfs:range ia:Context ;
    rdfs:label "same unit as" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The two contexts are one unit seen through a different kind of member: Contoso as its people, its accounts, its resources. Symmetric; stored once per pair. Each side still holds one kind of member, and the two hold different kinds." .

# ─── Relationship types (PrincipalRelationships.relationshipType) ────────────

ia:owner a owl:ObjectProperty ; ia:typeValue "Owner" ; ia:storedIn ia:PrincipalRelationship ;
    rdfs:domain ia:Principal ; rdfs:range ia:Principal ;
    rdfs:label "owner" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The object is an owner of the subject (typically of an AI agent or service principal)." .
ia:sponsor a owl:ObjectProperty ; ia:typeValue "Sponsor" ; ia:storedIn ia:PrincipalRelationship ;
    rdfs:domain ia:Principal ; rdfs:range ia:Principal ;
    rdfs:label "sponsor" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The object is a sponsor of the subject (typically of a guest account)." .

# ─── Columns ──────────────────────────────────────────────────────────────────
# One property per column name, named exactly like the column. rdfs:domain lists
# every core table that has the column; ia:sqlType is its PostgreSQL type.

ia:accountCount a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:Identity ;
    rdfs:range xsd:integer ;
    rdfs:label "accountCount" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Number of accounts linked to this person." .
ia:accountEnabled a owl:DatatypeProperty ; ia:sqlType "boolean" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:IdentityMember ) ] ;
    rdfs:range xsd:boolean ;
    rdfs:label "accountEnabled" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Whether the account can sign in. On IdentityMembers a copy taken when the link was made." .
ia:accountType a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:IdentityMember ;
    rdfs:range xsd:string ;
    rdfs:label "accountType" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Account category detected by Account Linking (Admin, Guest, Service, Shared, Secondary, …)." .
ia:accountTypePattern a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:IdentityMember ;
    rdfs:range xsd:string ;
    rdfs:label "accountTypePattern" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The naming pattern that classified accountType." .
ia:accountTypes a owl:DatatypeProperty ; ia:sqlType "jsonb" ;
    rdfs:domain ia:Identity ;
    rdfs:range rdf:JSON ;
    rdfs:label "accountTypes" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The account categories this person holds." .
ia:addedAt a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain ia:ContextMember ;
    rdfs:range xsd:dateTime ;
    rdfs:label "addedAt" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When the member was added." .
ia:addedBy a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:ContextMember ia:ContextRole ia:ContextRelationship ) ] ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:MembershipSource ;
    rdfs:label "addedBy" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Who added the member." .
ia:analystNotes a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Identity ;
    rdfs:range xsd:string ;
    rdfs:label "analystNotes" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Free-text analyst notes on the person." .
ia:analystOverride a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:IdentityMember ;
    rdfs:range xsd:string ;
    rdfs:label "analystOverride" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An analyst's verdict on a link (confirmed / rejected / moved); Account Linking honours it on every run." .
ia:analystVerified a owl:DatatypeProperty ; ia:sqlType "boolean" ;
    rdfs:domain ia:Identity ;
    rdfs:range xsd:boolean ;
    rdfs:label "analystVerified" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An analyst has verified this person." .
ia:assignmentStatus a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ResourceAssignment ;
    rdfs:range xsd:string ;
    rdfs:label "assignmentStatus" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source system's own status word for the assignment." .
ia:assignmentType a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ResourceAssignment ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:AssignmentType ;
    rdfs:label "assignmentType" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "How the access is held." .
ia:assignmentTypes a owl:DatatypeProperty ; ia:sqlType "jsonb" ;
    rdfs:domain ia:System ;
    rdfs:range rdf:JSON ;
    ia:status "unused" ;
    rdfs:label "assignmentTypes" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Meant to list the assignment types a system emits. Nothing reads or writes it." .
ia:capabilityId a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Resource ;
    rdfs:range xsd:string ;
    rdfs:label "capabilityId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Generated from extendedAttributes.capabilityId for the effective-access engine." .
ia:catalogId a owl:DatatypeProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:Resource ;
    rdfs:range xsd:string ;
    rdfs:label "catalogId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The governance catalog (GovernanceCatalogs.id) a business role belongs to. GovernanceCatalogs is outside the core model." .
ia:childResourceId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:ResourceRelationship ;
    rdfs:range ia:Resource ;
    ia:ingestAlias "childExternalId" ;
    rdfs:label "childResourceId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The child (target) resource." .
ia:city a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Identity ;
    rdfs:range xsd:string ;
    rdfs:label "city" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The person's city." .
ia:companyName a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Identity ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "companyName" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Company name." .
ia:complianceState a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ResourceAssignment ;
    rdfs:range xsd:string ;
    rdfs:label "complianceState" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source system's compliance verdict for the assignment." .
ia:contextId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:ContextMember ia:ContextRole ia:ContextRelationship ia:Interview ia:Claim ia:MemberOverride ia:ChangeRequest ) ] ;
    rdfs:range ia:Context ;
    ia:ingestAlias "contextExternalId" ;
    rdfs:label "contextId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The context." .
ia:contextCategory a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:ContextCategory ;
    rdfs:label "contextCategory" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The template this context falls under. NULL for a synced value nobody has placed yet." .
ia:role a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ContextRole ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:ContextRoleType ;
    rdfs:label "role" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Accountable or Responsible." .
ia:relatedContextId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:ContextRelationship ;
    rdfs:range ia:Context ;
    rdfs:label "relatedContextId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The other context of the link." .
ia:contextType a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:string ;
    rdfs:label "contextType" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What kind of grouping this is (Department, OrgUnit, Tag, Cluster, LogicalApplication, …). An open vocabulary." .
ia:country a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Identity ;
    rdfs:range xsd:string ;
    rdfs:label "country" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The person's country." .
ia:createdAt a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Context ia:ContextRole ia:ContextRelationship ia:Interview ia:Claim ) ] ;
    rdfs:range xsd:dateTime ;
    rdfs:label "createdAt" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When the context row was created." .
ia:createdByUser a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:string ;
    rdfs:label "createdByUser" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The analyst who created a manual context." .
ia:createdDateTime a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Resource ia:PrincipalRelationship ) ] ;
    rdfs:range xsd:dateTime ;
    rdfs:label "createdDateTime" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When the object was created in the source (PrincipalRelationships: when the row was created)." .
ia:deletedAt a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Resource ia:ResourceAssignment ) ] ;
    rdfs:range xsd:dateTime ;
    rdfs:label "deletedAt" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Soft-delete tombstone: set when the source stopped reporting the row; NULL while live." .
ia:department a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Identity ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "department" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Department name as a plain attribute (organisational placement itself is a Context)." .
ia:description a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:System ia:Resource ia:Context ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "description" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Free-text description." .
ia:directAssignmentCount a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:integer ;
    rdfs:label "directAssignmentCount" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Stored count of Direct (resource, holder) pairs over the resources in this context." .
ia:directMemberCount a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:integer ;
    rdfs:label "directMemberCount" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Stored count of direct members." .
ia:directorySystemId a owl:ObjectProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:System ;
    rdfs:range ia:System ;
    rdfs:label "directorySystemId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The directory system whose principals this system references but does not own (Azure RM -> Entra ID)." .
ia:displayName a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:System ia:Principal ia:Resource ia:Identity ia:Context ia:IdentityMember ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "displayName" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Human-readable name. On IdentityMembers a copy of the account name." .
ia:effect a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ResourceAssignment ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:AssignmentEffect ;
    rdfs:label "effect" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What the assignment does to effective access." .
ia:eligibleAssignmentCount a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:integer ;
    rdfs:label "eligibleAssignmentCount" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Stored count of Eligible (resource, holder) pairs over the resources in this context." .
ia:email a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Identity ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "email" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "E-mail address." .
ia:employeeId a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Identity ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "employeeId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Employee number." .
ia:enabled a owl:DatatypeProperty ; ia:sqlType "boolean" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:System ia:Resource ) ] ;
    rdfs:range xsd:boolean ;
    rdfs:label "enabled" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Whether the system or resource is enabled." .
ia:expirationDateTime a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain ia:ResourceAssignment ;
    rdfs:range xsd:dateTime ;
    rdfs:label "expirationDateTime" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When the assignment expires." .
ia:extendedAttributes a owl:DatatypeProperty ; ia:sqlType "jsonb" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:System ia:Principal ia:Resource ia:Identity ia:Context ia:ResourceAssignment ia:ResourceRelationship ia:PrincipalRelationship ) ] ;
    rdfs:range rdf:JSON ;
    rdfs:label "extendedAttributes" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Source-specific attributes that have no column of their own." .
ia:externalId a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Resource ia:Context ia:PrincipalRelationship ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "externalId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The object's id in its source system." .
ia:givenName a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Identity ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "givenName" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Given name." .
ia:governanceResource a owl:DatatypeProperty ; ia:sqlType "boolean" ;
    rdfs:domain ia:Resource ;
    rdfs:range xsd:boolean ;
    rdfs:label "governanceResource" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The resource is a governance construct that governs other access (business roles)." .
ia:governed a owl:DatatypeProperty ; ia:sqlType "boolean" ;
    rdfs:domain ia:ResourceAssignment ;
    rdfs:range xsd:boolean ;
    rdfs:label "governed" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The row is governance intent (a business-role / access-package assignment) rather than observed access. Part of the key." .
ia:holderCount a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:integer ;
    rdfs:label "holderCount" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Stored count of distinct holders over the resources in this context." .
ia:hrAccountId a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Identity ;
    rdfs:range xsd:string ;
    rdfs:label "hrAccountId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The HR record id the person is anchored on." .
ia:hrIndicators a owl:DatatypeProperty ; ia:sqlType "jsonb" ;
    rdfs:domain ia:IdentityMember ;
    rdfs:range rdf:JSON ;
    rdfs:label "hrIndicators" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Signals that made this account look HR-authoritative." .
ia:hrScore a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:IdentityMember ;
    rdfs:range xsd:integer ;
    rdfs:label "hrScore" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "How strongly this account looks like the HR record." .
ia:identityId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:IdentityMember ia:ResourceAssignment ia:ContextRole ia:Interview ia:Claim ) ] ;
    rdfs:range ia:Identity ;
    ia:ingestAlias "identityExternalId" ;
    rdfs:label "identityId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The person. On ResourceAssignments set instead of principalId for person-level assignments; on ContextInterviews the interviewee, on ContextClaims the person the claim is about, when that is a person." .
ia:indirectAssignmentCount a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:integer ;
    rdfs:label "indirectAssignmentCount" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Stored count of Indirect (resource, holder) pairs over the resources in this context." .
ia:isHidden a owl:DatatypeProperty ; ia:sqlType "boolean" ;
    rdfs:domain ia:Resource ;
    rdfs:range xsd:boolean ;
    rdfs:label "isHidden" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Hidden from the default views." .
ia:isHrAnchored a owl:DatatypeProperty ; ia:sqlType "boolean" ;
    rdfs:domain ia:Identity ;
    rdfs:range xsd:boolean ;
    rdfs:label "isHrAnchored" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The person is anchored on an HR record." .
ia:isHrAuthoritative a owl:DatatypeProperty ; ia:sqlType "boolean" ;
    rdfs:domain ia:IdentityMember ;
    rdfs:range xsd:boolean ;
    rdfs:label "isHrAuthoritative" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "This account is the HR-authoritative one." .
ia:isPrimary a owl:DatatypeProperty ; ia:sqlType "boolean" ;
    rdfs:domain ia:IdentityMember ;
    rdfs:range xsd:boolean ;
    rdfs:label "isPrimary" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "This is the person's primary account." .
ia:jobTitle a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Identity ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "jobTitle" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Job title." .
ia:lastCalculatedAt a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:dateTime ;
    rdfs:label "lastCalculatedAt" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When the stored counts were last recalculated." .
ia:lastSyncDateTime a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain ia:System ;
    rdfs:range xsd:dateTime ;
    rdfs:label "lastSyncDateTime" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When the system was last synced." .
ia:linkConfidence a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Identity ia:IdentityMember ) ] ;
    rdfs:range xsd:integer ;
    rdfs:label "linkConfidence" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Account Linking confidence score; NULL for crawler-sourced links." .
ia:linkedAt a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain ia:Identity ;
    rdfs:range xsd:dateTime ;
    rdfs:label "linkedAt" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When Account Linking last linked the person." .
ia:linkSignals a owl:DatatypeProperty ; ia:sqlType "jsonb" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Identity ia:IdentityMember ) ] ;
    rdfs:range rdf:JSON ;
    rdfs:label "linkSignals" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The signals Account Linking matched on." .
ia:mail a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Resource ;
    rdfs:range xsd:string ;
    rdfs:label "mail" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Mail address of a mail-enabled resource." .
ia:managerId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:Principal ;
    rdfs:range ia:Principal ;
    ia:ingestAlias "managerExternalId" ;
    rdfs:label "managerId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The manager's ACCOUNT." .
ia:managerIdentityId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:Identity ;
    rdfs:range ia:Identity ;
    ia:ingestAlias "managerIdentityExternalId" ;
    rdfs:label "managerIdentityId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The manager as a PERSON." .
ia:memberId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:ContextMember ia:MemberOverride ia:ChangeRequest ) ] ;
    rdfs:range [ a owl:Class ; owl:unionOf ( ia:Identity ia:Resource ia:Principal ia:System ) ] ;
    ia:ingestAlias "memberExternalId" ;
    rdfs:label "memberId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The member; memberType names its table." .
ia:memberType a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ContextMember ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:EntityKind ;
    rdfs:label "memberType" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Which kind of node memberId is." .
ia:modifiedDateTime a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Resource ia:PrincipalRelationship ) ] ;
    rdfs:range xsd:dateTime ;
    rdfs:label "modifiedDateTime" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When the object was last modified in the source (PrincipalRelationships: when the row was last modified)." .
ia:officeLocation a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Identity ;
    rdfs:range xsd:string ;
    rdfs:label "officeLocation" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The person's office." .
ia:origin a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ResourceAssignment ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:AssignmentOrigin ;
    rdfs:label "origin" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Where the assignment came from, as the source records it. Optional." .
ia:originDetail a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ResourceAssignment ;
    rdfs:range xsd:string ;
    rdfs:label "originDetail" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source's own word for the origin." .
ia:orphanStatus a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Identity ;
    rdfs:range xsd:string ;
    owl:deprecated true ;
    rdfs:label "orphanStatus" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Orphan-ness is the generated Orphaned Accounts context now; the column is kept in the schema for compatibility." .
ia:ownerUserId a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:string ;
    rdfs:label "ownerUserId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Whatever the source calls the owner of the grouping (free text, resolved to a principal for display)." .
ia:parentContextId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:Context ;
    rdfs:range ia:Context ;
    ia:ingestAlias "parentExternalId" ;
    rdfs:label "parentContextId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The parent context in the tree." .
ia:parentResourceId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:ResourceRelationship ;
    rdfs:range ia:Resource ;
    ia:ingestAlias "parentExternalId" ;
    rdfs:label "parentResourceId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The parent (source) resource." .
ia:photo a owl:DatatypeProperty ; ia:sqlType "bytea" ;
    rdfs:domain ia:Principal ;
    rdfs:range xsd:base64Binary ;
    rdfs:label "photo" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Profile photo (sent base64 to the ingest)." .
ia:photoContentType a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Principal ;
    rdfs:range xsd:string ;
    rdfs:label "photoContentType" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "MIME type of the photo." .
ia:photoFetchedAt a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain ia:Principal ;
    rdfs:range xsd:dateTime ;
    rdfs:label "photoFetchedAt" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When the photo was last fetched; set with a NULL photo means \"has none\"." .
ia:policyId a owl:DatatypeProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:ResourceAssignment ;
    rdfs:range xsd:string ;
    rdfs:label "policyId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The assignment policy (AssignmentPolicies.id) behind a governed assignment. AssignmentPolicies is outside the core model." .
ia:primaryPrincipalId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:Identity ;
    rdfs:range ia:Principal ;
    rdfs:label "primaryPrincipalId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The person's primary account." .
ia:principalId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:ResourceAssignment ia:PrincipalRelationship ia:IdentityMember ia:ContextRole ia:Interview ia:Claim ) ] ;
    rdfs:range ia:Principal ;
    ia:ingestAlias "principalExternalId", "userExternalId" ;
    rdfs:label "principalId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The account. On ResourceAssignments NULL when identityId is set; on PrincipalRelationships the subject that HAS the owner / sponsor; on ContextInterviews the interviewee, on ContextClaims the account the claim is about." .
ia:principalType a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:ResourceAssignment ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "principalType" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The kind of account. On Principals it selects the subclass; on ResourceAssignments it is a denormalised copy of the holder's type." .
ia:propagationScope a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ResourceAssignment ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:PropagationScope ;
    rdfs:label "propagationScope" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Where along a containment hierarchy the assignment applies." .
ia:relatedPrincipalId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:PrincipalRelationship ;
    rdfs:range ia:Principal ;
    ia:ingestAlias "relatedPrincipalExternalId" ;
    rdfs:label "relatedPrincipalId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The owner / sponsor." .
ia:relationshipType a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:ResourceRelationship ia:PrincipalRelationship ia:ContextRelationship ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "relationshipType" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The relationship type: one of the ia:typeValue of the properties stored in this edge table." .
ia:resourceCount a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:integer ;
    rdfs:label "resourceCount" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Stored count of resources in this context." .
ia:resourceId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:ResourceAssignment ;
    rdfs:range ia:Resource ;
    ia:ingestAlias "resourceExternalId" ;
    rdfs:label "resourceId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The resource that is held." .
ia:resourceType a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Resource ia:ResourceAssignment ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "resourceType" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The kind of resource (open vocabulary). On Resources it selects the subclass; on ResourceAssignments it is a denormalised copy used to partition reconciles." .
ia:resourceTypes a owl:DatatypeProperty ; ia:sqlType "jsonb" ;
    rdfs:domain ia:System ;
    rdfs:range rdf:JSON ;
    ia:status "unused" ;
    rdfs:label "resourceTypes" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Meant to list the resource types a system emits. Nothing reads or writes it." .
ia:riskScore a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Resource ) ] ;
    rdfs:range xsd:integer ;
    rdfs:label "riskScore" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Latest risk score, denormalised from RiskScores." .
ia:riskTier a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Resource ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "riskTier" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Latest risk tier, denormalised from RiskScores." .
ia:roleName a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ResourceRelationship ;
    rdfs:range xsd:string ;
    rdfs:label "roleName" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The role the child plays inside the parent (for example the access-package resource role)." .
ia:roleOriginSystem a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ResourceRelationship ;
    rdfs:range xsd:string ;
    rdfs:label "roleOriginSystem" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Where that role is defined." .
ia:scopeSystemId a owl:ObjectProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:Context ;
    rdfs:range ia:System ;
    rdfs:label "scopeSystemId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The system a synced or generated context is scoped to." .
ia:sourceAlgorithmId a owl:DatatypeProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:string ;
    rdfs:label "sourceAlgorithmId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The context-algorithm (ContextAlgorithms.id) that generated the context. ContextAlgorithms is outside the core model." .
ia:sourceInstanceKey a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:string ;
    rdfs:label "sourceInstanceKey" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Distinguishes several trees generated by one plugin on one system." .
ia:sourceRunId a owl:DatatypeProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:string ;
    rdfs:label "sourceRunId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The plugin run that generated the context." .
ia:state a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ResourceAssignment ;
    rdfs:range xsd:string ;
    rdfs:label "state" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source system's state word for the assignment (for example Delivered)." .
ia:surname a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Identity ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "surname" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Surname." .
ia:syncEnabled a owl:DatatypeProperty ; ia:sqlType "boolean" ;
    rdfs:domain ia:System ;
    rdfs:range xsd:boolean ;
    rdfs:label "syncEnabled" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Whether the system is synced." .
ia:systemId a owl:ObjectProperty ; ia:sqlType "integer" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Resource ia:ResourceAssignment ia:ResourceRelationship ia:PrincipalRelationship ) ] ;
    rdfs:range ia:System ;
    rdfs:label "systemId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The system that sourced the row." .
ia:systemType a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:System ;
    rdfs:range xsd:string ;
    rdfs:label "systemType" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The connector kind (EntraID, Omada, CSV, …). Together with tenantId the system key." .
ia:targetNodeId a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Resource ;
    rdfs:range xsd:string ;
    rdfs:label "targetNodeId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Generated from extendedAttributes.targetNodeId: the node a capability resource applies to." .
ia:targetType a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:EntityKind ;
    rdfs:label "targetType" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Which kind of node the context groups." .
ia:tenantId a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:System ;
    rdfs:range xsd:string ;
    rdfs:label "tenantId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The tenant / instance the system connects to." .
ia:totalMemberCount a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:integer ;
    rdfs:label "totalMemberCount" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Stored count of members including sub-contexts." .
ia:updatedAt a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Principal ia:Resource ia:ResourceAssignment ia:ResourceRelationship ia:PrincipalRelationship ia:Context ia:ContextRole ) ] ;
    rdfs:range xsd:dateTime ;
    rdfs:label "updatedAt" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When the row was last written by the ingest (full-sync reconcile cutoff)." .
ia:userRenamed a owl:DatatypeProperty ; ia:sqlType "boolean" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:boolean ;
    rdfs:label "userRenamed" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An analyst renamed this generated context; re-runs keep the name." .
ia:userReparented a owl:DatatypeProperty ; ia:sqlType "boolean" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:boolean ;
    rdfs:label "userReparented" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An analyst moved this generated context; re-runs keep the placement." .
ia:variant a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Context ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:ContextVariant ;
    rdfs:label "variant" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "How the context came to exist." .
ia:visibility a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Resource ;
    rdfs:range xsd:string ;
    rdfs:label "visibility" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Visibility as the source reports it (Public / Private for groups)." .

# Columns of the knowledge tables (ContextInterviews, ContextClaims,
# ContextMemberOverrides) and the provenance column they add to ContextRoles
# (migrations 099, 100, 101).
ia:sourceClaimId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:ContextRole ;
    rdfs:range ia:Claim ;
    rdfs:label "sourceClaimId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The interview claim this role was confirmed from. NULL for every other role, and once the interview is deleted." .
ia:objectContextId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:Claim ;
    rdfs:range ia:Context ;
    rdfs:label "objectContextId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What an activity, expertise or duty claim is about: an Activity, Expertise or Duty context. Set when the claim is confirmed (found by name, or created); NULL for every other claim and when the object is deleted." .
ia:interviewId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:Claim ;
    rdfs:range ia:Interview ;
    rdfs:label "interviewId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The interview that makes the claim." .
ia:intervieweeName a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Interview ;
    rdfs:range xsd:string ;
    rdfs:label "intervieweeName" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The interviewee's name when the transcript was uploaded; the source keeps it after a crawl removes the account." .
ia:interviewedAt a owl:DatatypeProperty ; ia:sqlType "date" ;
    rdfs:domain ia:Interview ;
    rdfs:range xsd:date ;
    rdfs:label "interviewedAt" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When the interview took place." .
ia:fileName a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Interview ;
    rdfs:range xsd:string ;
    rdfs:label "fileName" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The transcript file as uploaded." .
ia:transcript a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Interview ;
    rdfs:range xsd:string ;
    rdfs:label "transcript" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The transcript as plain text, one line per turn; every quote is a verbatim part of it." .
ia:language a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Interview ;
    rdfs:range xsd:string ;
    rdfs:label "language" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The language of the transcript (en, nl)." .
ia:extractionStatus a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Interview ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:ExtractionStatus ;
    rdfs:label "extractionStatus" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "How far reading it with the local model got." .
ia:extractionMessage a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Interview ;
    rdfs:range xsd:string ;
    rdfs:label "extractionMessage" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Why a run failed, or what a finished run left out." .
ia:extractionStartedAt a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain ia:Interview ;
    rdfs:range xsd:dateTime ;
    rdfs:label "extractionStartedAt" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When the last run started." .
ia:model a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Interview ;
    rdfs:range xsd:string ;
    rdfs:label "model" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The model that read it." .
ia:createdBy a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Interview ;
    rdfs:range xsd:string ;
    rdfs:label "createdBy" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Who uploaded it." .
ia:claimKind a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:ClaimKind ;
    rdfs:label "claimKind" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What the claim states." .
ia:subjectKind a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:ClaimSubjectKind ;
    rdfs:label "subjectKind" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Whether the claim is about the context or a person." .
ia:subjectName a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:string ;
    rdfs:label "subjectName" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The person as named in the interview, matched or not." .
ia:subjectMatch a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:SubjectMatch ;
    rdfs:label "subjectMatch" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "How the person was matched; NULL when they were not." .
ia:attribute a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Claim ia:ChangeRequest ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "attribute" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "A property claim's attribute name; a role claim's relation as said (owner, notOwner, dayToDay, delegate, member, other); a membership claim's status (current, former, joined, left, rejoined). On a change request (AttributeUpdate): the attribute to change in the source." .
ia:value a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:string ;
    rdfs:label "value" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What the claim says." .
ia:periodFrom a owl:DatatypeProperty ; ia:sqlType "date" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:date ;
    rdfs:label "periodFrom" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The start of the period the claim is about, when the interview gives one." .
ia:periodTo a owl:DatatypeProperty ; ia:sqlType "date" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:date ;
    rdfs:label "periodTo" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The end of the period the claim is about, when the interview gives one." .
ia:periodText a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:string ;
    rdfs:label "periodText" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The period as said (early years, now)." .
ia:quote a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:string ;
    rdfs:label "quote" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The words of the transcript the claim rests on, verbatim." .
ia:confidence a owl:DatatypeProperty ; ia:sqlType "numeric" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:decimal ;
    rdfs:label "confidence" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "How clearly the transcript states it, 0 to 1. Not a decision." .
ia:roleSuggestion a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:ContextRoleType ;
    rdfs:label "roleSuggestion" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The ContextRole a confirmed role claim becomes, by fixed rules on its relation." .
ia:claimStatus a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:ClaimStatus ;
    rdfs:label "claimStatus" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Where the claim stands in review." .
ia:relevance a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:ClaimRelevance ;
    rdfs:label "relevance" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "How much the claim matters for identity and access governance, by fixed rules and the model's own tier. NULL (before tiers) reads as high." .
ia:quoteStart a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:integer ;
    rdfs:label "quoteStart" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Where the quote starts in the stored transcript (a string offset), for the transcript view. NULL when not found." .
ia:quoteEnd a owl:DatatypeProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:integer ;
    rdfs:label "quoteEnd" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Where the quote ends in the stored transcript (exclusive)." .
ia:proposedBy a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:Claim ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:ClaimProposer ;
    rdfs:label "proposedBy" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Who proposed the claim." .
ia:decidedBy a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Claim ia:MemberOverride ) ] ;
    rdfs:range xsd:string ;
    rdfs:label "decidedBy" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Who decided it." .
ia:decidedAt a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain [ a owl:Class ; owl:unionOf ( ia:Claim ia:MemberOverride ) ] ;
    rdfs:range xsd:dateTime ;
    rdfs:label "decidedAt" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When it was decided." .
ia:claimId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:MemberOverride ;
    rdfs:range ia:Claim ;
    rdfs:label "claimId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The claim the decision was made on; deleting its interview deletes the override with it." .
ia:overrides a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:MemberOverride ;
    rdfs:range xsd:string ;
    rdfs:label "overrides" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source whose member list the decision overrides, by its name when decided (an upload, a system, the rule that derives it, the member list kept by hand)." .

# ─── Change requests (migration 103; docs/architecture/change-requests.md) ───
# What should change in a source an analyst's decision overrides. Knowledge, like
# the claim and the override it rests on: never a node, never a way of holding access.
ia:ChangeRequest a owl:Class ; rdfs:subClassOf ia:Knowledge ;
    rdfs:label "Change request" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What should change in a source that an analyst's decision overrides: which source (targetSystemId, its name when raised), which kind of change (changeKind), about what (a context, a member, an attribute, with their names when raised), resting on which claim and override. The override acts in Identity Atlas at once; the request records the correction still owed to the source, because the source's next sync or re-import would bring the old fact back. Raised only where a source can be corrected (a context synced from a system or an uploaded list), never for a context Identity Atlas owns. Nobody closes it by hand: it is resolved when the data shows the change, and withdrawn when the decision is undone. At most one open request per change." ;
    ia:table "ChangeRequests" ; ia:identifierColumn "id" ; ia:identifierSqlType "uuid" .

ia:ChangeKind a owl:Class ;
    rdfs:label "Change kind" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The kind of change a change request asks of its source: an entity, a relationship or an attribute." .
ia:ChangeKind_EntityCreate a owl:NamedIndividual, ia:ChangeKind ; ia:typeValue "EntityCreate" ;
    rdfs:label "EntityCreate" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source misses something that exists." .
ia:ChangeKind_EntityDelete a owl:NamedIndividual, ia:ChangeKind ; ia:typeValue "EntityDelete" ;
    rdfs:label "EntityDelete" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source lists something that no longer exists." .
ia:ChangeKind_RelationshipAdd a owl:NamedIndividual, ia:ChangeKind ; ia:typeValue "RelationshipAdd" ;
    rdfs:label "RelationshipAdd" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source should link the member to the context." .
ia:ChangeKind_RelationshipRemove a owl:NamedIndividual, ia:ChangeKind ; ia:typeValue "RelationshipRemove" ;
    rdfs:label "RelationshipRemove" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source should no longer link the member to the context: a person marked former by a decision." .
ia:ChangeKind_AttributeUpdate a owl:NamedIndividual, ia:ChangeKind ; ia:typeValue "AttributeUpdate" ;
    rdfs:label "AttributeUpdate" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "An attribute in the source should read expectedValue instead of currentValue." .

ia:ChangeRequestStatus a owl:Class ;
    rdfs:label "Change request status" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Where a change request stands. Set by the data and the decisions, not by hand." .
ia:ChangeRequestStatus_open a owl:NamedIndividual, ia:ChangeRequestStatus ; ia:typeValue "open" ;
    rdfs:label "open" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source does not show the change yet." .
ia:ChangeRequestStatus_resolved a owl:NamedIndividual, ia:ChangeRequestStatus ; ia:typeValue "resolved" ;
    rdfs:label "resolved" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source shows the change: the member is no longer listed, or the context is gone." .
ia:ChangeRequestStatus_withdrawn a owl:NamedIndividual, ia:ChangeRequestStatus ; ia:typeValue "withdrawn" ;
    rdfs:label "withdrawn" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The decision it rested on was undone, or a later decision contradicts it." .

ia:changeKind a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:ChangeKind ;
    rdfs:label "changeKind" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "What kind of change the source should make." .
ia:targetSystemId a owl:ObjectProperty ; ia:sqlType "integer" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range ia:System ;
    rdfs:label "targetSystemId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source to correct: the system or uploaded list the context is synced from. Cleared when the system is removed." .
ia:targetName a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range xsd:string ;
    rdfs:label "targetName" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The source's name when the request was raised." .
ia:contextName a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range xsd:string ;
    rdfs:label "contextName" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The context's name when the request was raised." .
ia:memberName a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range xsd:string ;
    rdfs:label "memberName" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The member's name when the request was raised." .
ia:currentValue a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range xsd:string ;
    rdfs:label "currentValue" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "For an AttributeUpdate: what the source says now." .
ia:expectedValue a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range xsd:string ;
    rdfs:label "expectedValue" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "For an AttributeUpdate: what the source should say." .
ia:summary a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range xsd:string ;
    rdfs:label "summary" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "One line a person can act on, such as: Remove Led from Klanten." .
ia:requestStatus a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range xsd:string ;
    ia:valueScheme ia:ChangeRequestStatus ;
    rdfs:label "requestStatus" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Where the request stands." .
ia:basisClaimId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range ia:Claim ;
    rdfs:label "basisClaimId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The claim whose decision raised it. Cleared when its interview is deleted; the request stays." .
ia:overrideId a owl:ObjectProperty ; ia:sqlType "uuid" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range ia:MemberOverride ;
    rdfs:label "overrideId" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "The override that acts in Identity Atlas until the source is corrected." .
ia:raisedBy a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range xsd:string ;
    rdfs:label "raisedBy" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Who made the decision that raised it." .
ia:raisedAt a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range xsd:dateTime ;
    rdfs:label "raisedAt" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When it was raised, or last raised again." .
ia:closedAt a owl:DatatypeProperty ; ia:sqlType "timestamp with time zone" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range xsd:dateTime ;
    rdfs:label "closedAt" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "When it was resolved or withdrawn; empty exactly while it is open." .
ia:closedReason a owl:DatatypeProperty ; ia:sqlType "text" ;
    rdfs:domain ia:ChangeRequest ;
    rdfs:range xsd:string ;
    rdfs:label "closedReason" ; rdfs:isDefinedBy <https://identityatlas.io/ontology> ;
    rdfs:comment "Why it was closed, in one sentence." .