Vendor / Supply-Chain Trust
Your application, its vendors, and their sub-processors down to the shared cloud host at the bottom of the stack. You only record direct "depends on" links; because dependence is transitive, the reasoner works out your full fourth-party exposure. Then mark the shared host compromised and watch the risk propagate up the chain to everyone who relies on it — with a consistency verdict.
Suppose the shared cloud host is compromised. Declare "an at-risk vendor is anything that depends on the cloud host" — and ask the engine who inherits the risk up the chain.
AtRiskVendor ≡ ∃ dependsOn.{CloudHost}Fourth-party exposure the engine derived — depend on a vendor, inherit theirs
You never listed "Your application depends on the cloud host" or "...on the data broker" — those are two and three hops down the chain. Because "depends on" is transitive, the reasoner computed your full transitive dependency set, which is your real fourth-party risk surface. These are reasoned − asserted: 4 triples (owl-rl).
Frequently asked questions
Is the Vendor / Supply-Chain Trust just a drawing?
No. The entities and relationships are curated from public sources (Fourth-party / sub-processor risk is standard TPRM practice), but the consequences are computed by the open-source Open Ontologies reasoning engine, not drawn by hand. The engine-derived panel lists exactly the facts the reasoner added on top of what was written down (43 reasoned minus 39 asserted triples), and the proposed-rule panel is the engine answering an OWL-DL query with a consistency verdict for the whole ontology.
What does "blast radius" mean here?
We add one new rule of intent and ask the reasoner what changes. Here the rule is: Suppose the shared cloud host is compromised. Declare "an at-risk vendor is anything that depends on the cloud host" — and ask the engine who inherits the risk up the chain. The engine (owl-dl, description logic SHIQ) returns exactly which entities are reclassified (4 here) and confirms the ontology stays logically consistent. You change a rule; the machine, not a person, works out every consequence.
What is Open Ontologies?
Open Ontologies (github.com/fabio-rovai/open-ontologies, MIT-licensed) is an open-source reasoning engine described as "Terraform for knowledge graphs." It loads RDF/Turtle, runs OWL-RL and OWL-DL reasoning over an in-memory triple store, answers SPARQL, and can produce checkable certificates for its conclusions. PlayCISO ships only the captured output it produces; the engine is not a runtime dependency.