Building the unified model — schema, entities, edges (construction log)

Status — under construction; foundation in validation

The ontological foundations log settled the name and direction (the why). This log is where the model gets actually built (the what and how): the Tier 1 schema, the entities and edges, the worked structure, and the first crosswalk. The foundation is being validated with colleagues; building proceeds in parallel and stays revisable until that lands. As each piece is built and validated, the related pages get promoted from tentative “stakes” to load-bearing “pillars” (see the last section).

Why this log exists

The foundations log gave us the categories (objective, risk, obligation, control, audit/finding), the three useful lenses (Control / Assurance / Risk), the name, and the field landscape. None of that is a built model yet — it’s the blueprint. This log turns the blueprint into something real:

1. The Tier 1 schema — concrete entity types, attributes, and typed edges (the buildable contract).
2. The worked model — the entities + relationships as an actual graph you can populate.
3. The first crosswalk — one real proving-ground crosswalk end-to-end through Crosswalker.

Schema deltas — the starting point

Falling directly out of the foundation: the entity types, attributes, and edges the model needs. (Draft — reconcile against spec/tier1.schema.json before committing; let the proving ground below confirm the minimum set rather than over-designing.)

Entity (node) types

Entity	Key attributes (beyond identity)	From the foundation
Objective	—	the teleological root (what everything serves)
Risk	inherent, residual, treatment (avoid / transfer / mitigate / accept), appetite_band	the risk lens
Obligation	authority_source (internal-governance / external-regulatory / contractual)	obligation ≠ compliance
Control	function_type (preventive / detective / corrective / directive), design_status, operating_status	the control + assurance lenses
Finding	severity, status (open / remediated / accepted), engagement_id	audit — the one genuinely new first-class node
Asset · Vendor · Process · Evidence · Incident	carried from the existing unified-model entity set	shared entities

Edge (relationship) types

Edge	Between	Carries
satisfies	control → obligation	—
mitigates	control → risk	effectiveness
concerns	finding → control / risk / obligation	—
evidences	evidence → control	status / freshness
requires	obligation → control	—
crosswalk	concept ↔ concept (framework ↔ framework)	STRM relation + SSSOM confidence / justification

No privileged node — “spine” is a profile/view, not a structural fact (per the foundation). Control-/risk-/obligation-centric are query lenses over this one graph.

Build plan

1. Reconcile these deltas against the v0.1 schema spec — what already exists, what’s new, what’s the minimum.
2. Define the entities + edges concretely (the worked model).
3. Build the first crosswalk (proving ground): NIST CSF 2.0 ↔ 800-53 — both public-domain, both held, and an official NIST concept-crosswalk exists — end-to-end through Crosswalker → render a coverage view.
4. Let the proving ground drive the schema — build one real crosswalk; let it reveal which deltas are actually needed instead of designing them in the abstract.
5. Validate the foundation + the built model with colleagues; revise.

From stakes to pillars

As each piece is built and validated, these related pages get upgraded from tentative “stakes” to settled “pillars” — and reconciled with the foundation (several still say “CRI at the center,” which is being demoted to a financial-sector-specific FI-only profile):

• Unified risk model — the canonical model page (still CRI-centered → reconcile to Control-center / no-spine)
• v0.1 schema spec — the Tier 1 contract these deltas land in
• Framework corpus + the registry — the data the model is built over
• The per-domain examples: internal audit · GRC / risk · regulatory compliance

Related

• GRC corpus end-to-end (use-case test) — the real-data test that drives this build: ingest → parse → crosswalk → query over the 253-file corpus, with the snags and the ecosystem bet
• Ontological foundations of the model — the why / name / direction this builds from
• Challenges 39 — spine · 40 — backbone · 41 — audit role + naming
• ETL & import (schema-as-primitive) · v0.1 schema spec