EU AI Act Article 50 — 20 days to seal | Get passport

DEFONEOS Open Ontology

APACHE 2.0RDF/OWLSPARQLMCP-NATIVEPALANTIR-KILLER

Palantir's $308B secret sauce — now open source. That's the Ontology.

The Object-Action-Function Model

The Palantir Ontology — the proprietary backbone behind Foundry, Gotham, and AIP — rests on four primitives: Objects, Links, Actions, Functions. DEFONEOS reimplements the same four primitives as open W3C standards with sovereign-by-design audit and MCP-native tooling.

1. Objects

An Object is a real-world entity in your operational picture: a vessel, a sensor, a person, a building, a runway, a drone swarm. Each Object carries:

2. Links

Links are typed relationships between Objects: vessel:9456321 carries cargo:crude_oil_50kt, vessel:9456321 reported_at port:rotterdam, vessel:9456321 shadowed_by vessel:9456790. Links support time-bounded validity and confidence weights.

3. Actions

Actions are state-changing operations: CreateReport, DispatchDrone, AuthoriseJam, EscalateToHuman. Each Action is gated by a BFT council vote, logged with who/what/when/why, and reversible by an inverse Action.

4. Functions

Functions are pure computations over Objects and Links: findDarkVesselsInRegion(lat, lon, radius, hours), predictTrajectory(objectId, t), riskScore(objectId). Functions run in the SOV3 substrate and can be called via MCP or SPARQL extension.

Why this model works

It maps cleanly onto how defence operators think. The same model serves maritime (vessel), land (vehicle, person, building), air (aircraft, drone), cyber (host, alert), and joint operations. It's the lingua franca that makes MCP servers interoperable — an MCP that emits vessels can be queried alongside an MCP that emits aircraft in a single SPARQL query.

Example: the same idea in 3 syntaxes

// Turtle (RDF)
@prefix defo: <https://defoneos.com/ontology#> .
@prefix ex: <https://example.org/maritime#> .

ex:vessel/IMO9456321 a defo:Vessel ;
    defo:name "MV Northern Star" ;
    defo:flag "PA" ;
    defo:length 290 ;
    defo:lastAIS "2026-07-05T14:23:00Z"^^xsd:dateTime ;
    defo:carries ex:cargo/crude_oil_50kt .

ex:cargo/crude_oil_50kt a defo:Cargo ;
    defo:type "HS 2709.00" ;
    defo:quantity 50000 ;
    defo:unit "MT" .

RDF/OWL Schema & Namespace

The DEFONEOS Ontology is published at https://defoneos.com/ontology# as a versioned RDF/OWL document. It extends schema.org and PROV-O for provenance.

PrefixNamespaceExamples
defo:https://defoneos.com/ontology#Vessel, Aircraft, Drone, Sensor, Person, Building, Action, Link
prov:http://www.w3.org/ns/prov#Entity, Activity, Agent, wasDerivedFrom
geo:http://www.w3.org/2003/01/geo/wgs84_pos#lat, lon, alt, SpatialThing
time:http://www.w3.org/2006/time#Instant, Interval, before, after
nato:https://nato.int/stanag/4677#FriendFoeIdentifier, TrackNumber
ji:https://jointisr.org/ontology#Track, Contact, Classification

Core classes

ClassSubclass ofKey properties
defo:Vesseldefo:PlatformIMO, MMSI, flag, length, beam, draft, cargo
defo:Aircraftdefo:PlatformICAO24, callsign, type, squawk
defo:Dronedefo:Aircraftclass (1-5 per JSP 936), serial, operator, geofence
defo:Sensordefo:Equipmenttype, model, lat/lon, coverage, frequency
defo:Trackji:Contactplatform, time, lat/lon/alt, heading, speed, confidence
defo:Reportprov:Entitysubject, predicate, object, source, confidence, sigil
defo:Actionprov:Activitytype, agent, target, parameters, bft_id, sigil
defo:Threatdefo:Classificationseverity, category, recommended_response

Why RDF/OWL and not JSON Schema

Interoperability
RDF is the only W3C-recommended standard for semantic interoperability. DEFONEOS data joins cleanly with NATO STANAGs, OS OpenData, EU customs, and any other modern ontology.
Inference
OWL reasoners (HermiT, Pellet, ELK) can derive new facts from existing ones. "All dark vessels in piracy zone are elevated risk" — express once, applies forever.
Provenance
PROV-O integration: every fact carries who, when, why, derived from what. Required for JSP 936 and any audit-grade regulator.
Federation
SPARQL 1.1 Federated Query lets you query across multiple triple stores in one query. DEFONEOS doesn't centralise — it federates.

DEFONEOS Ontology vs Palantir Ontology

DimensionDEFONEOSPalantir
Open Source✅ Apache 2.0❌ Proprietary
StandardsRDF/OWL, SPARQL, JSON-LD, PROV-OProprietary "Photon" / "Ontology" types
ReasoningHermiT, Pellet, ELK, StardogProprietary rule engine
MCP Integration✅ Native (every Object is MCP-toolable)❌ Custom SDK only
Audit TrailEd25519 SIGIL, Bitcoin-anchoredCentralised logs, opaque to customer
HostingOn-prem, air-gap, sovereign VM, MOD cloudAWS GovCloud / Foundry-on-AWS only
Data sovereignty100% customer-owned, never leaves UKUS CLOUD Act applies — data is reachable by US agencies
License costFree (Apache 2.0); Support £50K+/yr$50M+/yr depending on seats & modules
Time to deployDays (single container)9-18 months enterprise engagement
OnboardingSelf-serve docs + Discord; Pro has dedicated PMForward-deployed engineers for 6+ months
ModificationCustomer-owned, fork-friendlyVendor-only changes; customer cannot modify engine

Why Palantir wins deals today (and why DEFONEOS wins them tomorrow)

Palantir wins because procurement officers recognise the brand and fear the alternative risk. Once a buyer has seen the DEFONEOS Ontology run a live maritime operation alongside a counter-drone exercise alongside an emergency services dispatch — all from the same RDF store — the procurement risk flips. "We trust the open, auditable, sovereign thing we can read and modify" beats "We trust the $50M/yr proprietary thing we cannot".

The killer feature: audit-grade provenance

Every Palantir ontology change goes into a centralised log. Regulators and auditors cannot independently verify it. With DEFONEOS, every change is Ed25519-signed by the BFT council that authorised it, hash-chained to the previous change, and optionally anchored to the Bitcoin blockchain. Auditors don't trust DEFONEOS — they verify it.

SPARQL Query Examples

DEFONEOS data is queryable via SPARQL 1.1 (with spatial extension). The same MCP servers that ingest data also serve SPARQL.

Find all dark vessels in the English Channel in the last 6 hours

PREFIX defo: <https://defoneos.com/ontology#>
PREFIX geo: <http://www.w3.org/2003/01/geo/wgs84_pos#>
PREFIX time: <http://www.w3.org/2006/time#>
PREFIX xsd: <http://www.w3.org/2001/XMLSchema#>

SELECT ?vessel ?name ?lastSeen ?confidence WHERE {
  ?track a defo:Track ;
         defo:platform ?vessel ;
         geo:lat ?lat ;
         geo:lon ?lon ;
         defo:timestamp ?lastSeen ;
         defo:confidence ?confidence .
  ?vessel a defo:Vessel ;
           defo:name ?name ;
           defo:dark true .

  FILTER(?lat > 49.0 && ?lat < 51.5 && ?lon > -2.0 && ?lon < 2.0)
  FILTER(?lastSeen > (NOW() - "PT6H"^^xsd:duration))
}
ORDER BY DESC(?confidence)
LIMIT 100

Find all drone swarms classified as Class 3+ near restricted airspace

PREFIX defo: <https://defoneos.com/ontology#>
PREFIX geo: <http://www.w3.org/2003/01/geo/wgs84_pos#>

SELECT ?drone ?class ?operator ?distance WHERE {
  ?drone a defo:Drone ;
         defo:droneClass ?class ;
         defo:operator ?operator ;
         geo:lat ?dLat ;
         geo:lon ?dLon .

  ?zone a defo:RestrictedAirspace ;
        geo:lat ?zLat ;
        geo:lon ?zLon ;
        defo:radius ?radius .

  BIND(geof:distance(?dLat, ?dLon, ?zLat, ?zLon) AS ?distance)

  FILTER(?class >= 3)
  FILTER(?distance < ?radius)
}
ORDER BY ?distance

Federated query: maritime MCP + aviation MCP + weather MCP

PREFIX defo: <https://defoneos.com/ontology#>

SELECT ?vessel ?aircraft ?wind WHERE {
  SERVICE <https://mcp.defoneos.com/aisstream/sparql> {
    ?vessel a defo:Vessel ; defo:lastSeen ?vT .
  }
  SERVICE <https://mcp.defoneos.com/opensky/sparql> {
    ?aircraft a defo:Aircraft ; defo:lastSeen ?aT .
  }
  SERVICE <https://mcp.defoneos.com/metoffice/sparql> {
    ?obs a defo:WeatherObservation ; defo:windSpeed ?wind .
  }
  FILTER(?vT > NOW() - "PT1H"^^xsd:duration)
  FILTER(?aT > NOW() - "PT1H"^^xsd:duration)
}

SIGIL Audit Trail

Every modification to the ontology — adding a class, changing a property, ingesting a new object, running an action — is recorded as a SIGIL entry. SIGILs are Ed25519-signed and chained. The chain is optionally anchored to Bitcoin (proofof.ai) for external immutability.

Sample SIGIL

H|defoneos|ontology|action=CreateObject|type=Vessel|imo=9456321|ts=2026-07-05T14:23:01Z|agent=aisstream-mcp|sigil=4f8a2c91e7b3d6a0|sig=0x9f4e2a...c83b
V|defoneos|bft-validator-09|approved|conf=0.94|rationale="IMO valid, AIS position consistent with satellite"|ts=2026-07-05T14:23:02Z
M|defoneos|ontology|property=lastSeen|target=vessel:9456321|new=2026-07-05T14:23:00Z|prev=2026-07-05T13:45:00Z|diff=38min|prev_sigil=4f8a2c91e7b3d69f
A|defoneos|bft-council|quorum=23/33|for=24|against=0|abstain=9|action=PromoteToDarkVessel|target=vessel:9456321

Audit properties

Compliance frameworks natively supported

FrameworkArticle/SectionHow SIGIL satisfies
UK JSP 936AI Assurance — AuditabilityFull lineage + BFT approvals for every model + decision
EU AI ActArticle 12 (Logging), 13 (Transparency)Automatic logging with cryptographic integrity; technical documentation exportable
ISO 42001A.6.1.2 (AI system lifecycle)Versioned ontology + full change history
NIST AI RMFGOVERN, MAP, MEASURE, MANAGEAll four functions log to SIGIL chain
UK DPA 2018 / GDPRArticle 30 (Records of Processing)Every data write is recorded with lawful basis + retention
MOD JSP 440Spectrum ManagementRF emissions SIGILed with frequency, power, time