https://governance.foundation/assets/js/ad824bc9.afb7e12f.js

1"use strict";(self.webpackChunkdocusaurus=self.webpackChunkdocusaurus||[]).push([["8933"],{8787(e,n,i){i.r(n),i.d(n,{metadata:()=>t,default:()=>h,frontMatter:()=>l,contentTitle:()=>o,toc:()=>c,assets:()=>a});var t=JSON.parse('{"id":"knowledgeontology/foundations/mitigation-and-interference-extension","title":"Mitigation and Interference Extension Note","description":"This page captures the next step beyond the thesis\'s strong treatment of prevention.","source":"@site/docs/knowledgeontology/foundations/mitigation-and-interference-extension.md","sourceDirName":"knowledgeontology/foundations","slug":"/knowledgeontology/foundations/mitigation-and-interference-extension/","permalink":"/knowledgeontology/foundations/mitigation-and-interference-extension/","draft":false,"unlisted":false,"tags":[],"version":"current","frontMatter":{"title":"Mitigation and Interference Extension Note","slug":"/knowledgeontology/foundations/mitigation-and-interference-extension/"},"sidebar":"docsSidebar","previous":{"title":"Events and Temporal Change Guide","permalink":"/knowledgeontology/foundations/events-and-temporal-change/"},"next":{"title":"Enterprise Architecture Ontology Mapping","permalink":"/knowledgeontology/foundations/enterprise-architecture-ontology-mapping/"}}'),r=i(74848),s=i(28453);let l={title:"Mitigation and Interference Extension Note",slug:"/knowledgeontology/foundations/mitigation-and-interference-extension/"},o,a={},c=[{value:"Why this page exists",id:"why-this-page-exists",level:2},{value:"Where prevention is sufficient",id:"where-prevention-is-sufficient",level:2},{value:"Where Governance Foundation must extend it",id:"where-governance-foundation-must-extend-it",level:2},{value:"Useful extension categories",id:"useful-extension-categories",level:2},{value:"1. Prevention",id:"1-prevention",level:3},{value:"2. Mitigation",id:"2-mitigation",level:3},{value:"3. Interference",id:"3-interference",level:3},{value:"4. Containment",id:"4-containment",level:3},{value:"5. Degradation management",id:"5-degradation-management",level:3},{value:"6. Recovery",id:"6-recovery",level:3},{value:"7. Resilience",id:"7-resilience",level:3},{value:"Suggested modeling distinctions",id:"suggested-modeling-distinctions",level:2},{value:"Severity and scope matter",id:"severity-and-scope-matter",level:2},{value:"Causal-chain view",id:"causal-chain-view",level:2},{value:"Governance examples",id:"governance-examples",level:2},{value:"Approval and review controls",id:"approval-and-review-controls",level:3},{value:"Incident response",id:"incident-response",level:3},{value:"Policy and authority design",id:"policy-and-authority-design",level:3},{value:"Practical candidate concepts for the ontology",id:"practical-candidate-concepts-for-the-ontology",level:2},{value:"Working rule for Governance Foundation",id:"working-rule-for-governance-foundation",level:2},{value:"Recommended next step",id:"recommended-next-step",level:2},{value:"Related reading",id:"related-reading",level:2}];function d(e){let n={a:"a",code:"code",h2:"h2",h3:"h3",li:"li",p:"p",strong:"strong",ul:"ul",...(0,s.R)(),...e.components};return(0,r.jsxs)(r.Fragment,{children:[(0,r.jsxs)(n.p,{children:["This page captures the next step beyond the thesis's strong treatment of ",(0,r.jsx)(n.strong,{children:"prevention"}),"."]}),"\n",(0,r.jsx)(n.p,{children:"It exists because the OntoUML thesis synthesis made one limitation very clear:"}),"\n",(0,r.jsx)(n.p,{children:(0,r.jsx)(n.strong,{children:"prevention is modeled well, but interference / mitigation is not yet modeled strongly enough for Governance Foundation."})}),"\n",(0,r.jsx)(n.h2,{id:"why-this-page-exists",children:"Why this page exists"}),"\n",(0,r.jsx)(n.p,{children:"The prevention model is powerful when the question is:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"how do we stop some target event from occurring?"}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:"But organisational reality often needs a broader family of intervention patterns, including:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"reducing likelihood"}),"\n",(0,r.jsx)(n.li,{children:"reducing intensity"}),"\n",(0,r.jsx)(n.li,{children:"delaying onset"}),"\n",(0,r.jsx)(n.li,{children:"containing spread"}),"\n",(0,r.jsx)(n.li,{children:"limiting blast radius"}),"\n",(0,r.jsx)(n.li,{children:"preserving critical function under stress"}),"\n",(0,r.jsx)(n.li,{children:"recovering after damage"}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:"Those are not all cleanly captured by prevention alone."}),"\n",(0,r.jsx)(n.h2,{id:"where-prevention-is-sufficient",children:"Where prevention is sufficient"}),"\n",(0,r.jsx)(n.p,{children:"The existing prevention framing is strong when an intervention:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"brings about a situation incompatible with a target event's activation conditions"}),"\n",(0,r.jsx)(n.li,{children:"breaks a causal chain upstream so the target event never occurs"}),"\n",(0,r.jsx)(n.li,{children:"blocks a disposition from manifesting under the required circumstances"}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:"This is a very useful core and should be preserved."}),"\n",(0,r.jsx)(n.h2,{id:"where-governance-foundation-must-extend-it",children:"Where Governance Foundation must extend it"}),"\n",(0,r.jsx)(n.p,{children:"Governance Foundation needs concepts for cases where the target event:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"still occurs, but in weaker form"}),"\n",(0,r.jsx)(n.li,{children:"still occurs, but later than it otherwise would"}),"\n",(0,r.jsx)(n.li,{children:"still occurs, but only in part of the system"}),"\n",(0,r.jsx)(n.li,{children:"still occurs, but with reduced downstream consequences"}),"\n",(0,r.jsx)(n.li,{children:"cannot be fully prevented, but can be absorbed and recovered from"}),"\n"]}),"\n",(0,r.jsxs)(n.p,{children:["That means the ontology needs more than binary ",(0,r.jsx)(n.code,{children:"prevented / not prevented"})," semantics."]}),"\n",(0,r.jsx)(n.h2,{id:"useful-extension-categories",children:"Useful extension categories"}),"\n",(0,r.jsx)(n.p,{children:"A practical first-pass extension set is:"}),"\n",(0,r.jsx)(n.h3,{id:"1-prevention",children:"1. Prevention"}),"\n",(0,r.jsx)(n.p,{children:"The target event does not occur because enabling conditions are blocked or causal precursors are interrupted."}),"\n",(0,r.jsx)(n.h3,{id:"2-mitigation",children:"2. Mitigation"}),"\n",(0,r.jsx)(n.p,{children:"The target event or harmful consequence still occurs, but its severity, reach, or damage is reduced."}),"\n",(0,r.jsx)(n.p,{children:"Examples:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"an outage still happens, but failover reduces impact"}),"\n",(0,r.jsx)(n.li,{children:"an attack still lands, but segmentation limits spread"}),"\n",(0,r.jsx)(n.li,{children:"a policy breach still occurs, but approval gates reduce consequences"}),"\n"]}),"\n",(0,r.jsx)(n.h3,{id:"3-interference",children:"3. Interference"}),"\n",(0,r.jsx)(n.p,{children:"An intervention disrupts, weakens, diverts, delays, or complicates a process without necessarily fully preventing it."}),"\n",(0,r.jsx)(n.p,{children:"Examples:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"throttling slows an attack chain"}),"\n",(0,r.jsx)(n.li,{children:"review checkpoints slow unsafe rollout"}),"\n",(0,r.jsx)(n.li,{children:"friction reduces probability of escalation"}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:"Interference is a broader family than prevention and can include partial blocking."}),"\n",(0,r.jsx)(n.h3,{id:"4-containment",children:"4. Containment"}),"\n",(0,r.jsx)(n.p,{children:"The harmful event/process is not stopped immediately, but its propagation boundary is constrained."}),"\n",(0,r.jsx)(n.p,{children:"Examples:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"isolating a compromised segment"}),"\n",(0,r.jsx)(n.li,{children:"quarantining a document/workflow/service"}),"\n",(0,r.jsx)(n.li,{children:"limiting authority scope during incident response"}),"\n"]}),"\n",(0,r.jsx)(n.h3,{id:"5-degradation-management",children:"5. Degradation management"}),"\n",(0,r.jsx)(n.p,{children:"The system continues in a reduced-capability mode instead of collapsing completely."}),"\n",(0,r.jsx)(n.p,{children:"Examples:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"read-only mode"}),"\n",(0,r.jsx)(n.li,{children:"fallback manual process"}),"\n",(0,r.jsx)(n.li,{children:"reduced service tier during incident response"}),"\n"]}),"\n",(0,r.jsx)(n.h3,{id:"6-recovery",children:"6. Recovery"}),"\n",(0,r.jsx)(n.p,{children:"The ontology should explicitly capture events and capabilities that restore an acceptable state after harm."}),"\n",(0,r.jsx)(n.p,{children:"Examples:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"rollback"}),"\n",(0,r.jsx)(n.li,{children:"restoration"}),"\n",(0,r.jsx)(n.li,{children:"reissuance"}),"\n",(0,r.jsx)(n.li,{children:"compensating control deployment"}),"\n",(0,r.jsx)(n.li,{children:"after-action remediation"}),"\n"]}),"\n",(0,r.jsx)(n.h3,{id:"7-resilience",children:"7. Resilience"}),"\n",(0,r.jsx)(n.p,{children:"Resilience should be treated not as a single event but as a structured capability/disposition of a system or organisation to:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"absorb disturbance"}),"\n",(0,r.jsx)(n.li,{children:"adapt under pressure"}),"\n",(0,r.jsx)(n.li,{children:"continue critical function"}),"\n",(0,r.jsx)(n.li,{children:"recover toward an acceptable operating state"}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"suggested-modeling-distinctions",children:"Suggested modeling distinctions"}),"\n",(0,r.jsx)(n.p,{children:"A clean runtime model will probably need to distinguish:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.strong,{children:"target event"})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.strong,{children:"target harmful consequence"})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.strong,{children:"intervention event"})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.strong,{children:"protected asset / subject / value"})}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"controlled situation"})," or desired post-intervention situation"]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"interference pattern"})," (block, weaken, delay, divert, contain, recover)"]}),"\n",(0,r.jsxs)(n.li,{children:[(0,r.jsx)(n.strong,{children:"effect strength"})," (full, partial, temporary, local, systemic)"]}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"severity-and-scope-matter",children:"Severity and scope matter"}),"\n",(0,r.jsx)(n.p,{children:"One major gap in binary prevention thinking is that interventions often vary along dimensions such as:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"severity reduced vs unchanged"}),"\n",(0,r.jsx)(n.li,{children:"duration reduced vs unchanged"}),"\n",(0,r.jsx)(n.li,{children:"geographic / organisational spread reduced vs unchanged"}),"\n",(0,r.jsx)(n.li,{children:"number of affected subjects reduced vs unchanged"}),"\n",(0,r.jsx)(n.li,{children:"recoverability improved vs unchanged"}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:"Governance Foundation should preserve these as first-class evaluation dimensions rather than hiding them in prose."}),"\n",(0,r.jsx)(n.h2,{id:"causal-chain-view",children:"Causal-chain view"}),"\n",(0,r.jsx)(n.p,{children:"This extension works best if modeled over causal chains."}),"\n",(0,r.jsx)(n.p,{children:"An intervention may act on:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"the triggering situation"}),"\n",(0,r.jsx)(n.li,{children:"an enabling condition"}),"\n",(0,r.jsx)(n.li,{children:"a participant capability/disposition"}),"\n",(0,r.jsx)(n.li,{children:"a mediating relationship/relator"}),"\n",(0,r.jsx)(n.li,{children:"an intermediate event in the chain"}),"\n",(0,r.jsx)(n.li,{children:"the consequence phase after the event begins"}),"\n"]}),"\n",(0,r.jsx)(n.p,{children:"This matters because prevention usually acts early in the chain, while mitigation and recovery often act later."}),"\n",(0,r.jsx)(n.h2,{id:"governance-examples",children:"Governance examples"}),"\n",(0,r.jsx)(n.h3,{id:"approval-and-review-controls",children:"Approval and review controls"}),"\n",(0,r.jsx)(n.p,{children:"These may:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"prevent bad changes from being approved"}),"\n",(0,r.jsx)(n.li,{children:"interfere with unsafe rollout speed"}),"\n",(0,r.jsx)(n.li,{children:"mitigate harm by inserting rollback points"}),"\n"]}),"\n",(0,r.jsx)(n.h3,{id:"incident-response",children:"Incident response"}),"\n",(0,r.jsx)(n.p,{children:"This may:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"fail to prevent initial compromise"}),"\n",(0,r.jsx)(n.li,{children:"contain propagation"}),"\n",(0,r.jsx)(n.li,{children:"mitigate service impact"}),"\n",(0,r.jsx)(n.li,{children:"support recovery to an acceptable state"}),"\n"]}),"\n",(0,r.jsx)(n.h3,{id:"policy-and-authority-design",children:"Policy and authority design"}),"\n",(0,r.jsx)(n.p,{children:"This may:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"prevent unauthorized action"}),"\n",(0,r.jsx)(n.li,{children:"reduce the blast radius of mistakes through delegated scope limits"}),"\n",(0,r.jsx)(n.li,{children:"support recovery through explicit escalation/reversal paths"}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"practical-candidate-concepts-for-the-ontology",children:"Practical candidate concepts for the ontology"}),"\n",(0,r.jsx)(n.p,{children:"Good candidates to carry forward include:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"Intervention 

1Event"}),"\n",(0,r.jsx)(n.li,{children:"Mitigation Event"}),"\n",(0,r.jsx)(n.li,{children:"Containment Event"}),"\n",(0,r.jsx)(n.li,{children:"Recovery Event"}),"\n",(0,r.jsx)(n.li,{children:"Degradation State"}),"\n",(0,r.jsx)(n.li,{children:"Resilience Capability"}),"\n",(0,r.jsx)(n.li,{children:"Protected Value / Protected Subject"}),"\n",(0,r.jsx)(n.li,{children:"Harmful Consequence"}),"\n",(0,r.jsx)(n.li,{children:"Acceptable Operating State"}),"\n",(0,r.jsx)(n.li,{children:"Blast Radius"}),"\n",(0,r.jsx)(n.li,{children:"Severity Level"}),"\n",(0,r.jsx)(n.li,{children:"Recovery Objective / Recovery Threshold"}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"working-rule-for-governance-foundation",children:"Working rule for Governance Foundation"}),"\n",(0,r.jsx)(n.p,{children:"Use the prevention model when the semantics are truly about non-occurrence."}),"\n",(0,r.jsx)(n.p,{children:"Extend beyond it when the real question is about:"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:"partial success"}),"\n",(0,r.jsx)(n.li,{children:"graceful failure"}),"\n",(0,r.jsx)(n.li,{children:"controlled degradation"}),"\n",(0,r.jsx)(n.li,{children:"consequence reduction"}),"\n",(0,r.jsx)(n.li,{children:"restoration"}),"\n",(0,r.jsx)(n.li,{children:"adaptation under stress"}),"\n"]}),"\n",(0,r.jsx)(n.h2,{id:"recommended-next-step",children:"Recommended next step"}),"\n",(0,r.jsx)(n.p,{children:"The next strong follow-on is to connect this extension work to enterprise architecture concepts so Governance Foundation can say where these intervention patterns live in services, applications, infrastru

1cture, organisations, and governance structures."}),"\n",(0,r.jsx)(n.h2,{id:"related-reading",children:"Related reading"}),"\n",(0,r.jsxs)(n.ul,{children:["\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.a,{href:"/knowledgeontology/foundations/ontouml-guide/",children:"OntoUML Guide"})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.a,{href:"/knowledgeontology/foundations/ontouml-research-todo/",children:"OntoUML Research TODO"})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.a,{href:"/knowledgeontology/foundations/events-and-temporal-change/",children:"Events and Temporal Change Guide"})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.a,{href:"/knowledgeontology/foundations/relationships-relators-guide/",children:"Relationships and Relators Guide"})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.a,{href:"/knowledgeontology/foundations/ontology-architecture/",children:"Ontology Architecture"})}),"\n",(0,r.jsx)(n.li,{children:(0,r.jsx)(n.a,{href:"/knowledgeontology/foundations/ontology-principles/",children:"Ontology Principles"})}),"\n"]})]})}function h(e={}){let{wrapper:n}={...(0,s.R)(),...e.components};return n?(0,r.jsx)(n,{...e,children:(0,r.jsx)(d,{...e})}):d(e)}},28453(e,n,i){i.d(n,{R:()=>l,x:()=>o});var t=i(96540);let r={},s=t.createContext(r);function l(e){let n=t.useContext(s);return t.useMemo(function(){return"function"==typeof e?e(n):{...n,...e}},[n,e])}function o(e){let n;return n=e.disableParentContext?"function"==typeof e.components?e.components(r):e.components||r:l(e.components),t.createElement(s.Provider,{value:n},e.children)}}}]);