Compliance Ontology

1,948 nodes and 1,075 edges across 7 compliance frameworks

Compliance Ontology

The compliance ontology is a directed graph encoding the relationships between regulatory frameworks, categories, articles, risk factors, mitigations, action types, data classifications, and resource types. It powers both the forward-chaining engine (rule-to-article mapping) and the Memgraph co-processor (graph traversal for RAG).

Graph Statistics

Metric	Value
Total nodes	1,948
Total edges	1,075
Frameworks	7
Categories	43
Articles	259
Risk Factors	12
Mitigations	1,068
Action Types	34
Data Classifications	6
Resource Types	6

Node Types

Framework

Top-level regulatory frameworks.

Supported: GDPR, HIPAA, SOC2, PCI-DSS, PII (general), OWASP (including LLM Top 10), ISO27001

Properties: id, label, jurisdiction

Category

Groupings within frameworks. E.g., gdpr:consent_management, hipaa:phi_safeguards.

Properties: id, label, framework, pagerank, community_id

Article

Specific regulation text. E.g., GDPR Art. 5(1)(c), HIPAA §164.312(a)(1).

Properties: id, label, description, text (full regulatory text), pagerank, betweenness, community_id

RiskFactor

Abstract risk concepts that link actions to articles. E.g., rf:data_exfiltration, rf:gdpr_consent_violation.

Properties: id, label, description, severity_weight, pagerank

Mitigation

Recommended controls and remediation steps.

Properties: id, text, effectiveness_score, community_id

ActionType

Action taxonomy entries. E.g., at:email_send, at:database_query.

Properties: id, label, risk_weight

DataClass

Data sensitivity classifications: public, internal, pii, pii_sensitive, financial, health, auth, legal.

Properties: id, label, sensitivity_level

ResourceType

Resource categories for target classification.

Properties: id, label

Edge Types

Edge Type	Source → Target	Description
has_category	Framework → Category	Framework contains this category
governed_by	Category → Article	Category governed by this article
triggers	RiskFactor → Article	Risk factor triggers this article’s applicability
mitigated_by	RiskFactor → Mitigation	Risk factor addressed by this mitigation
implies_risk	ActionType → RiskFactor	Action type implies this risk
accesses	ActionType → DataClass	Action type accesses this data class
has_policy	Framework → Policy	Framework defines this policy
subscribes_to	Tenant → Framework	Tenant subscribes to this framework

Graph Traversal Patterns

Article Discovery for Risk Factors

MATCH (at:ActionType {id: $action_type})-[:IMPLIES_RISK]->(rf:RiskFactor)
MATCH (rf)-[:TRIGGERS]->(article:Article)
MATCH (cat:Category)-[:GOVERNED_BY]->(article)
MATCH (fw:Framework)-[:HAS_CATEGORY]->(cat)
WHERE fw.id IN $tenant_frameworks
RETURN fw.id AS framework, article.id, article.pagerank
ORDER BY article.pagerank DESC

Mitigation Coverage

MATCH (rf:RiskFactor)-[:MITIGATED_BY]->(mit:Mitigation)
WHERE rf.id IN $risk_factor_ids
WITH mit, COUNT(DISTINCT rf) AS covers
RETURN mit.text, covers
ORDER BY covers DESC

Cross-Framework Impact

MATCH (rf:RiskFactor {id: $rf_id})-[:TRIGGERS]->(article:Article)
MATCH (cat:Category)-[:GOVERNED_BY]->(article)
MATCH (fw:Framework)-[:HAS_CATEGORY]->(cat)
RETURN DISTINCT fw.id AS framework, COUNT(article) AS violations

Storage

The ontology is stored as a JSON file at graph/src/quint_graph/data/compliance_ontology.json (~558 KB) and loaded as a networkx.DiGraph at startup:

from quint_graph.graph import load_ontology

ontology = load_ontology()  # Cached singleton
articles = ontology.get_nodes_by_type("article")
mitigations = ontology.get_mitigations_for_risk("rf:data_exfiltration")

When Memgraph is enabled, the ontology is loaded into Memgraph via scripts/load_ontology_memgraph.py for graph-native queries.