The edge set

A concrete, versioned, public vocabulary. This is the reference to paste into an agent session before asking it to build a graph, and the place to argue with if you think an edge is missing or wrongly named.

Provenance

Appendix A of the 28 July 2026 brief cites “the concepts glossary” as the authority on edge-grammar discipline and lists the established edge set. No such file exists in the source repository; it lives in another project. That absence is gap G5 (the fifth of the twelve gaps catalogued in the brief pack, its list of things the corpus could not supply), and the pack's recommendation was that this book should either import the glossary or become it.

This chapter becomes it. Which means: the fifteen edge names below are quoted from the corpus and are load-bearing. Several of the inverse names are not. Where the corpus does not supply one, we propose it, and say so in the table. Proposed names are a starting point for disagreement, not a standard.

The fifteen established edges

Cited in Appendix A of briefs/07/28/regulation-graph-and-acceptability/v0.33.53__arch-brief__…every-paragraph-is-a-graph… as the established set. Every one of them is a verb; every one is directed.

Edge	Inverse	Reads as	Where the inverse comes from
`connected_to`	`connected_to`	A is connected to B	symmetric
`observed_on`	`bears_observation`	this evidence was observed on this system	proposed here
`backed_by`	`evidences`	this fact is backed by this evidence	proposed here
`measured_by`	`measures`	this fact is measured by this measure	proposed here
`grants`	`granted_by`	this role grants this capability	proposed here
`reaches`	`reachable_from`	this grant reaches this asset	proposed here
`enables`	`enabled_by`	this capability enables this action	proposed here
`exposes`	`exposed_by`	this fact exposes this blast radius	proposed here
`gives_rise_to`	`arises_from`	this vulnerability gives rise to this risk	in the corpus
`protected_by`	`protects`	this asset is protected by this control	proposed here
`conditional_on`	`conditions`	this control is conditional on this fact	proposed here
`defeated_by`	`defeats`	this control is defeated by this attack	proposed here
`owned_by`	`owns`	this system is owned by this role	in the corpus
`accepted_by`	`accepted`	this risk is accepted by this role	proposed here
`underwritten_by`	`underwrites`	this acceptance is underwritten by this role	proposed here

One row is in tension with this book's own rule. connected_to is the only symmetric edge in the set, and a symmetric edge with a broad verb sits uncomfortably close to the one that is banned. It survives because in the graphs that use it it means something specific (physically or logically attached) rather than “associated somehow”. Treat it as a last resort: wherever you can name what kind of connection it is, name it, and the query gets better. If you think it should be dropped from the set, say so.

Also used in the worked graphs

These appear in the browser-isolation graph and the 2FA (two-factor authentication) graph but are not in the fifteen. They are listed separately rather than folded in, because folding them in would quietly enlarge a set somebody else cited.

Edge	Inverse	Reads as
`impairs`	`impaired_by`	this risk impairs this asset
`emits`	`emitted_by`	this control emits this detection signal

One name is deliberately absent, and its absence is a rule. There is no generic association edge in this set. If you find yourself wanting one, the graph is telling you that you have not yet decided what the relationship is: rule 1.

Node types, from the worked graphs

Node types are more domain-specific than edges, so this is a worked example rather than a standard. These are the types in the two most complete graphs in the corpus.

The risk / assurance chain (browser isolation, 59 nodes / 75 edges)

Reality · Twin · Asset · Evidence · Measure · Fact · Grant · AuthorizationClosure · BlastRadius · Vulnerability · Risk · PreventiveControl · DetectiveControl · Owner · AcceptanceDecision

AuthorizationClosure is the one to notice: the transitive union of every grant reachable over assume-role, pass-role and wildcard edges. It is called the agentic union, and for an agent the closure is the rating floor, not the nominal grant. It is a node type that only exists because the graph can compute it.

The instance graph (2FA, 51 nodes / 53 edges)

Risk (9) · Actor (9) · Evidence (6) · Interval (6) · Fact (5) · Impact (3) · System (2) · Vulnerability (2) · DataClass (2) · Asset · ThreatAgent · Attack · Obligation · Register · Twin · Agent

The 2FA graph in full →

The one that is actually running

Everything above is designed. One typed property graph in this project is live repository data, the issue tracker's own configuration: 12 node types, 10 verb/inverse edge types with domain and range constraints, 71 nodes and 141 edges across 107 issue files, with edges stored bidirectionally.

It is the cheapest credibility in this book and the most instructive artefact in this chapter, for two reasons. It demonstrates that domain and range constraints on a verb pair are enough structure to be useful. And it ships the banned edge, which is what the rule looks like when nothing enforces it. What ships, in full →

Rules for extending this set

A new edge needs a sentence. If you cannot write “A ⟨verb⟩ B” and have a person in that business say it out loud, it is not an edge yet.
And its inverse needs a different sentence. If the inverse is just the same sentence read backwards, you have one relationship where you thought you had two. Check whether the direction you chose is the one with lower fan-out.
Domain and range, stated. Which node types may sit at each end. This is what makes a malformed graph detectable rather than merely wrong.
No generic association edge, ever. Not even temporarily. Temporarily is how the one in link-types.json got there.
Prefer adding an edge to adding a validation rule. Enrichment, not enforcement. The graph grows; it does not constrain.

For an agent

Use these fifteen verbs where they fit: connected_to, observed_on, backed_by, measured_by, grants, reaches, enables, exposes, gives_rise_to, protected_by, conditional_on, defeated_by, owned_by, accepted_by, underwritten_by. Each is directed and takes a distinct inverse. Do not invent a generic association edge. When you need a verb that is not here, name it as a sentence, state its inverse, state its domain and range, and mark it as an extension rather than folding it into this set.

← 3 · The rules you can apply tomorrow5 · Against schema-first →