Pankaj Kumar — cloudbadal007

Enterprise Ontology Architect | AI Agent Governance | OWL/SHACL | MCP/A2A I build deterministic governance layers for enterprise AI agents — formal OWL/SHACL constraint enforcement that runs before agent execution, not after in an audit. Focused on making enterprise AI provably safe. 📝 Medium (@cloudpankaj) — 60+ articles on enterprise ontology and AI agent governance · 49K+ views · 🌐 ontoarc.ai · 💼 LinkedIn --- > New here? → [Decision Matrix](DECISION-MATRIX.md) — which tool > for which job, in one table.

How the repositories fit together

This curated set of repositories forms five distinct stacks. You can enter at any layer depending on what you need. For the complete catalog — including a few tools not featured in the five stacks below — see the Decision Matrix.

┌─────────────────────────────────────────────────────────────┐
│  STACK 1: DOMAIN ONTOLOGY                                   │
│  What the rules are (the rulebook)                          │
├─────────────────────────────────────────────────────────────┤
│  STACK 2: ENFORCEMENT LAYER                                 │
│  Is this action allowed right now?                          │
├─────────────────────────────────────────────────────────────┤
│  STACK 3: IDENTITY + AUTHORITY LAYER                        │
│  Who is acting, on whose authority?                         │
├─────────────────────────────────────────────────────────────┤
│  STACK 4: PORTABILITY + BRIDGE LAYER                        │
│  Survives platform migration without losing constraints     │
├─────────────────────────────────────────────────────────────┤
│  STACK 5: RESILIENCE LAYER                                  │
│  Survives schema and model change without breaking          │
└─────────────────────────────────────────────────────────────┘

---

Stack 1 — Domain Ontology (The Rulebook)

These repos define or export domain models as OWL/SHACL — the portable rulebook layer before enforcement. | Repository | What it does | Stars | |---|---|---| | foundry-ontology-open | Open-source Foundry ObjectType / ActionType / LinkType library with OWL and SHACL export — mirrors Foundry's three-layer ontology model in portable W3C standards Foundry itself does not export. Includes energy-asset and human-services case studies. | ⭐ 56 | | from-protege-to-production-python | Takes an OWL ontology from Protégé authoring to a running Python integration. The practical starting point for anyone new to the stack. | ⭐ 11 | | powerbi-ontology-extractor | Extracts latent ontologies from Power BI data models and converts them to OWL/SHACL. Turns 20M existing dashboards into AI-ready semantic contracts. Exports directly to OntoGuard and universal-agent-connector formats. | ⭐ 30 | Relevant articles: - Building Your First Ontology: A Hands-On Tutorial - From Protégé to Production: Integrating Your Ontology with Python - The Power BI Ontology Paradox ---

Stack 2 — Enforcement Layer (Is This Action Allowed?)

These repos implement the deterministic check that runs before an agent executes any action. | Repository | What it does | Stars | |---|---|---| | ontoguard-ai | Semantic firewall for AI agents. Validates proposed actions against an OWL ontology and returns ALLOWED or DENIED with a human-readable reason and suggested alternatives. Ships as pip package, CLI, and MCP server with LangChain/AutoGen/CrewAI integrations. 244 tests. | ⭐ 20 | | ontology-firewall | Core ontology firewall pattern — domain rules as checked axioms rather than application-layer lint. | ⭐ 9 | | copilot-ontology-firewall | Ontology firewall integration for Microsoft Copilot and Copilot Studio agents. | ⭐ 3 | | ontology-rag-firewall | Firewall layer for RAG pipelines — validates retrieved context against domain constraints before it reaches the LLM. | ⭐ 6 | Relevant articles: - OntoGuard: I Built an Ontology Firewall for AI Agents in 48 Hours - Your AI Agents Can Steal From Each Other. I Built the Layer That Stops It - Google Secured Its AI Agents With 5 Layers. I Built the Sixth - I Fed a $2.3M Contract Into a RAG Pipeline. Here's What It Missed ---

Stack 3 — Identity + Authority Layer (Who Is Acting?)

These repos handle agent identity, permissions, audit, and the "no anonymous process" requirement — every execution must trace to an authority. | Repository | What it does | Stars | |---|---|---| | universal-agent-connector | MCP infrastructure with ontology-driven routing. Every agent is registered with a unique ID, authenticates with an API key, holds explicit resource-level permissions, and every action produces an immutable record: agent_id → action → resource → outcome. Includes version control with rollback — keeps a full history and authority trail without asserting durable identity across config changes. | ⭐ 7 | | agentic-mesh-blueprint | Reference architecture for coordinating enterprise AI agents through shared semantics using MCP + A2A + OWL. Handles authority and delegation across agent meshes. | ⭐ 9 | | agentic-mesh-security | SHACL-gated semantic security layer for cross-platform A2A agent delegation. Keeps authority crisp when agents hand off work to other agents. | ⭐ 5 | Relevant articles: - Universal Agent Connector: MCP + Ontology = Production-Ready AI Infrastructure - MCP + A2A + OWL Ontology: I Built the Agentic Mesh Your Enterprise Agents Are Missing - EU AI Act Meets $140 Billion in Unclaimed Benefits ---

Stack 4 — Portability + Bridge Layer (Survives Platform Migration)

These repos ensure that ontology semantics and constraints survive when you move between enterprise platforms — the constraint layer does not get lost in translation. | Repository | What it does | Stars | |---|---|---| | owl-portability-layer | Vendor-neutral OWL/SHACL semantic layer sitting above 10 platform adapters (OpenAI Frontier, IBM watsonx, Palantir Foundry, Microsoft Fabric IQ, Dataverse, Google Knowledge Catalog, ServiceNow, AWS AgentCore, Grok-on-Databricks, Snowflake). The ontology is the single semantic source of truth. Each adapter forces explicit mapping of every concept crossing a platform boundary — nothing drops silently. | ⭐ 25 | | human-services-ai-architecture | Reference architecture for EU AI Act High-Risk compliance in government welfare and social services AI. OWL/SHACL rule slices for eligibility, fraud, and temporal benefit entitlements. | ⭐ 4 | Relevant articles: - I Tried to Migrate a Palantir Foundry Ontology to Fabric IQ - Microsoft vs Palantir: Two Paths to Enterprise Ontology - IBM watsonx vs Google Knowledge Catalog vs AWS AgentCore - Anthropic Can Read Your COBOL. IBM Lost $31 Billion. ---

Stack 5 — Resilience Layer (Survives Schema and Model Change)

These repos handle the harder problem: keeping agents and ontologies coherent when the underlying data model changes around them. | Repository | What it does | Stars | |---|---|---| | ontology-mcp-self-healing | Self-healing multi-agent system using ontologies and MCP to automatically adapt when database schemas change. Agents recover without manual intervention. | ⭐ 17 | | self-healing-ai-agent | Agent-level self-healing pattern — when a schema change breaks a query, the agent uses the ontology to reroute rather than fail. | ⭐ 5 | Relevant articles: - The Self-Healing Problem: Why Your AI Breaks When Engineers Rename Columns - Building a Self-Healing AI Agent: When Database Schemas Change, Your Code Doesn't Break - From Ontology to Production: Building a Self-Healing Multi-Agent System with MCP ---

Cross-stack combinations

Different problems call for different repo combinations. Here are the most useful groupings:

If you are building a governed AI agent from scratch

Start here: foundry-ontology-open (domain rules) → ontoguard-ai (enforcement) → universal-agent-connector (identity + audit)

If you are migrating from one enterprise platform to another

Start here: owl-portability-layer (constraint bridge) → foundry-ontology-open (domain ontology export) → legacy-to-logic (if migrating from a legacy welfare or benefits system)

If you are building for EU AI Act High-Risk compliance

Start here: human-services-ai-architecture (compliance architecture) → ontoguard-ai (enforcement layer) → agentic-mesh-security (delegation audit)

If you need RAG pipelines that don't hallucinate domain rules

Start here: ontology-rag-firewall (validated retrieval) → foundry-ontology-open (domain rulebook) → ontoguard-ai (action enforcement)

If you are stress-testing a platform's semantic layer

Start here: owl-portability-layer (the adapter that exposes what each platform drops) — see the 10 platform adapter READMEs for Palantir, Microsoft, Google, AWS, IBM, Snowflake, Databricks, ServiceNow, OpenAI, Grok

If you need a security layer for multi-agent delegation

Start here: agentic-mesh-blueprint (architecture) → agentic-mesh-security (SHACL-gated delegation) → universal-agent-connector (identity + authority) ---

The core thesis

Enterprise AI platforms deliver semantic understanding — retrieval, context, embeddings. None of them ship formal OWL/SHACL constraint enforcement. The agent layer needs a deterministic validation check before execution, not a probabilistic audit after. These repositories are that layer — open-source, extensible, and built for domains where wrong decisions have real consequences. ---

Learning path (if you are new to this stack)

1. Understanding Ontology: The Brain Your AI Has Been Missing 2. Building Your First Ontology: A Hands-On Tutorial 3. From Protégé to Production: Integrating Your Ontology with Python 4. Why Every AI Agent Needs an Ontology 5. OntoGuard: I Built an Ontology Firewall for AI Agents in 48 Hours 6. Full roadmap → 60+ articles across 6 learning tracks

Collapse