Reasoning Teaching Lab
The smallest ontology that shows what a reasoner is for. Users hold roles; roles grant permissions. You never say "Alice can approve payments" — the engine derives it by chaining role to permission. Then try to grant the approver submit rights too: because approve and submit are separated duties, the engine refuses the change and proves the model would be inconsistent. A forged conclusion, rejected.
Give the approver submit rights too. Approver and Submitter are separated duties (declared disjoint), so ask the engine to accept the change — and watch it refuse.
Alice a Submitter (Alice is already an Approver)Access the engine derived — chained from role to permission
You only wrote "user has role" and "role grants permission". Because "holds" is transitive and both are kinds of it, the reasoner chained them into effective access. This is how RBAC answers "what can this person actually do?" without anyone writing it down per-user. These are reasoned − asserted: 13 triples (owl-rl).
Frequently asked questions
Is the Reasoning Teaching Lab just a drawing?
No. The entities and relationships are curated from public sources (Separation-of-duties is a standard control (e.g. SOX, ISO 27001 A.5.3)), but the consequences are computed by the open-source Open Ontologies reasoning engine, not drawn by hand. The engine-derived panel lists exactly the facts the reasoner added on top of what was written down (51 reasoned minus 38 asserted triples), and the proposed-rule panel is the engine answering an OWL-DL query with a consistency verdict for the whole ontology.
Why does the engine reject the proposed change?
The proposed change is: Alice a Submitter (Alice is already an Approver). Alice would be both an Approver and a Submitter, but those classes are declared owl:disjointWith (separation of duties). The ABox becomes unsatisfiable, so the engine reports the model inconsistent and refuses to derive anything from the forged fact — exactly the guardrail a hand-drawn graph cannot give you. A hand-drawn graph would simply accept the new edge; a reasoner checks it against every rule in the schema and refuses a conclusion that cannot be true.
What is Open Ontologies?
Open Ontologies (github.com/fabio-rovai/open-ontologies, MIT-licensed) is an open-source reasoning engine described as "Terraform for knowledge graphs." It loads RDF/Turtle, runs OWL-RL and OWL-DL reasoning over an in-memory triple store, answers SPARQL, and can produce checkable certificates for its conclusions. PlayCISO ships only the captured output it produces; the engine is not a runtime dependency.