Schema Governance
apullrequestreviewtoolformeaning

Nobody decided your schema. It accumulated.

Your data model is a shared language. Govern it like one.

Every schema change arrives as a proposal — its rationale, its blast radius and its provenance attached, validated by machines and signed by at least two people. Then it reads your documents into the graph those types describe, and every answer cites the line it came from.

See how it works
At least two signatures
Technical and governance, from two different people. Never one — and as many technical reviewers as a domain requires.
Four validation tiers
It parses, a reasoner checks it contradicts nothing (OWL), the shapes are enforced (SHACL), and a model argues against it.
Rights stop at a domain
Viewer, reviewer, admin, owner — and a role only counts in the domains somebody has been granted.
Immutable URIs
A term is born into a domain and never moves. Versions are releases, not names.
Full provenance
Which agent, which model, which prompt, which evidence, which precedents.
The problem

And it is still accumulating.

This is the history your schema already has. Every column in it is recoverable except the first one, and the first one is the only column that matters.

schema history · the last 14 months 0 recorded decisions
what you live withwhat actually happenedwho decided
The same thing, named three times Vendor, Supplier and Counterparty were minted by three teams in the same quarter. Nobody noticed for a year.
Changes land without consequences A field is re-typed on Tuesday. Four consumers break on Thursday. Nobody connects the two.
The rationale lives in someone’s head Why is Product not a subclass of Asset? The person who decided left in March.
Exports drift from the model The TypeScript types, the JSON Schema and the docs each describe a slightly different system.
Governance means a meeting Every schema change queues behind a fortnightly call that half the reviewers miss.
Nobody can prove what changed There is no diff, no changelog, no version. Just a database that is different than it was.
Six symptoms, one cause: no one was ever asked to sign.
Where this sits

You have probably been shown two kinds of tool.

The graph builders
Point a model at your documents and a graph appears. Fast, and genuinely impressive in a demo. Then nobody can say who approved a type, the model invents a property, and six months later the graph is the thing nobody trusts. Extraction with no governance.
The governance incumbents
Workflow, approvals, a change register, an audit trail. All real, all necessary — and every proposal is still written by hand, so your three ontologists remain the bottleneck they were before you bought it. Process with no drafting.
Skema
The machine drafts and validates; two people decide; the decision is kept and cited back on the next draft. You get the speed of the first with the defensibility of the second, and neither one on its own is what we are. Drafted, validated, then governed.
Source to graph

Messy information goes in. A governed ontology comes out.

A contract PDF, a spreadsheet of orders, an API payload, a product catalogue and somebody’s meeting notes. Five sources, five formats, no shared vocabulary between them.

Structured files are profiled deterministically; prose is read by the extraction agent. Every candidate concept keeps a pointer back to the evidence that produced it.

Concepts are matched against your schema and the open vocabularies before anything is minted. What survives becomes a proposal with its relationships attached.

Two people sign each change. What remains is a governed ontology — versioned, provenance-carrying, and exportable in five formats.

The world
pdfsupply-contract-2026.pdf
csvorders_q3.csv
jsonerp_api_response.json
mdvendor-call-notes.md
xmlproduct-catalog.xml
no shared vocabulary 5 sources · 5 formats 5 sources · 5 formats 5 sources · 5 formats
What was found
Suppliercontract.pdf · party clause
Productcatalog.xml · <item>
Contractcontract.pdf · header
Amountorders_q3.csv · total_value
Customererp_api.json · buyer_id
SettlementDateorders_q3.csv · settle_dt
The graph governed
6 types · 5 relationships · 2 signatures · v2.5.0
Turtle JSON Schema TypeScript GraphQL Dictionary
How the model is found

Your documents already contain a model. Nobody has written it down.

Skema finds repeated structure in evidence, then asks people to govern what it found.

ReadEvidence stays attached to its source.
RepeatPatterns gain confidence across distinct observations.
ProposeDiscovery creates a candidate, not a change.
GovernOnly an approved proposal becomes authoritative.

Piyush joined Acme as a senior engineer and now leads the Delhi team.

When the evidence moves

A governed claim has more than two states.

Evidence can move after a decision is made.
The decision does not disappear with it.

the record
claim
Supplier A is party to Contract B
signed · 14 Mar 20262 signatures
never rewritten
what supports it now
stands

The evidence it was admitted on is still the evidence.

contract.pdfat decision
party_clause §2at decision
nothing to do
evidence moved

Same claim. Different evidence.

contract.pdfsuperseded
amendment_2.pdf22 Apr
party_record_222 Apr
still supported · reported, not absorbed
held

An open identity question remains.

party_record_222 Apr
supplier_a · supplier_a_inunresolved
not a refusal · not quietly a yes
withdrawn

Support fell below the bar.

quarantined, not deleted · released if the evidence returns
the only state that moves anything
unaccounted

The rule that admitted it is no longer the rule in force.

policy v4admitted this claim
policy v5is silent on it
superseded governance is not refuted evidence
re-reads of the same claim

Evidence can move. Governance does not pretend it didn’t.

The machine reports the change. Unsigning is a human act, and it stays one — a claim two people signed is never withdrawn by a recount.

What every fact carries

A fact you cannot account for is a rumour with a schema.

Evidence moves. The fact still has to account for itself — who it is about, why it is believed, where it is true, and how it can genuinely go.

governed fact
Piyushworks atAcme
governed · 2 signatures fact / id/9f4c…
accountable

Identity is established once. Evidence does not drift it.

“Piyush” “Piyush Jha” “the engineer” hr_letter.pdf
resolved id/9f4c… still id/9f4c…
shown to you before anything merges

Every belief has a chain, and the chain is rebuilt, never stored.

  1. factid/9f4c… works at id/3b07…
  2. decisionadmitted · 14 Mar 2026
  3. rulepolicy v4
  4. signatures2 · the domain’s quorum
  5. sourcecontract.pdf · p.4
a copy is exactly the thing an erasure cannot reach

Scope travels on the fact, not in a filter somebody has to remember.

finance
works at Acme
salary
operations
works at Acme
salary
the answer is different, not merely hidden

Deleting the source is not deletion.

sourcecontract.pdfremoved
factid/9f4c…
derived3 surfaces found
graph projectionremoved
export snapshotremoved
downstream copyreported
what it reached, and what it could not

A fact without its history is only half a fact.

Provenance is what makes an explanation possible. Erasure is what keeps that provenance accountable.

The canvas

A schema is not one enormous graph, so it is no longer drawn as one.

Every view answers a different question. Start with inheritance, focus a class, inspect a relationship.

clickfocus a class
selectinspect a relationship
dragarrange it, and it stays
colourwhere the term came from

Understand the shape you have. Then decide what belongs in it.

Reuse before you mint

Import a standard term and see what it would do, before it does it.

An identifier here never moves once it exists. So importing shows you the plan first, and mints nothing until you say so.

  1. 01MatchAlready yours? Then nothing is minted.
  2. 02MintNew? Created, and told where it attached.
  3. 03FlagClose in meaning? Minted, and flagged.
  4. 04ProposeNothing crosses until someone approves it.
How it works

Seven steps from raw source to governed term.

The model drafts. Machines validate. People decide. The order never changes.

01

Any source

CSV and JSON are profiled deterministically. No model reads your data.

  • Structured files never reach a model — column names, datatypes, cardinality and null rates are computed.
  • PDFs and notes are split on their own structure: headings, clauses, tables.
  • Every quote keeps the page and line it came from, and that pointer survives all the way into the graph.
02

Extract and correct

You fix the extraction before anything is drafted.

  • Rename fields, correct datatypes, mark the columns that should be ignored.
  • Nothing is ever proposed from a field you rejected.
  • This is the last point at which a mistake is cheap, so it is the point you are given.
03

Find or create

Your schema is searched first. Minting a new URI is the last resort.

  • Your own governed terms are matched before anything external is considered.
  • Then the open vocabularies — reuse beats invention, and reuse is recorded as such.
  • A term is born into a domain and never moves. Versions are releases, not renames.
04

Validate

Four tiers run before a human is involved. Failures never reach the queue.

  • Parse — it is syntactically a schema at all.
  • OWL consistency — a reasoner finds no contradiction with what you already assert.
  • SHACL shapes — your own constraints still hold after the change.
  • Adversarial critique — a model argues against the proposal, citing precedents. It advises; it never decides.
05

Review

At least two signatures, from two different people. Never one.

  • Technical and governance sign separately, and the same person cannot do both.
  • A domain can require more than one technical signature — governance stays at one, and the floor is never self-approval.
  • Blast radius arrives with the proposal: terms touched, references broken, modules crossed.
  • Competency tests run against the live schema — unit tests for meaning, not for code.
06

Apply

The term enters the governed schema with its full decision record attached.

  • The change is appended to an HMAC-chained log. Nothing already written is ever edited.
  • Status is derived by reading that log forward, never by writing back over it.
  • Which means “what did this look like in March” is a query, not an archaeology project.
07

Learn

Accepted decisions become precedents, cited back to the drafting agent.

  • Every verdict is kept with the reason the reviewer gave for it.
  • Those reasons are quoted to the model on the next proposal in the same area.
  • So it stops proposing what you have already rejected, and starts naming things the way you name them.
The review

Every proposal arrives with its consequences already worked out.

Before a human decides, the system has already traced what changes, what breaks, and what needs attention.

  1. 01MeasureWhat the change touches, before anyone sees it.
  2. 02ValidateFour tiers. Failures never reach the queue.
  3. 03CritiqueA model argues against it. It advises; it never decides.
  4. 04DecideRouted to whoever owns the module. People decide.

A duplicate opens a conversation, not a ticket — the machine scores the match and names the two people who introduced each term, and nothing is ever auto-deleted.

Why it compounds

It gets better at your company, not at companies in general.

Every decision becomes context for the next one.

week 1Reviewers reject a third of proposals.
week 6Rejected patterns stop returning.
month 6Reviewers spend time only where judgment is needed.

A tool that has watched two hundred of your decisions is not the same product as the one you installed.

Six months of decisions is not a log. It is a vocabulary.

The log is yours and it exports. Six months of “why we said no” is not something a replacement can be handed — and we would rather say that plainly than have you discover it.

Capabilities

From source material to governed release.

Every one of these is a surface in the workspace today.

01source

Read the world

Documents in every quote carries its page

A PDF is split on its own headings and pages, not a fixed window. Each quoted phrase carries the page it came from, so every proposal traces back to a sentence you can go and read.

Facts, not just types prose, with the sentence attached

Read prose into the graph your schema describes. Every assertion quotes the sentence it came from, and a policy audit checks them against the rules you govern.

Open vocabularies standards in, plan shown first

schema.org, FOAF, DCTerms and SKOS ship with it, and you can register your own for the same governed import path. Take a vocabulary whole, or open it and import the dozen terms you actually want. Every import shows its plan first: what it would mint, what you already have, and where each term would attach.

02model

See what you have

The schema canvas three levels, three different graphs

Three levels, each building a different graph: inheritance alone, then one class and what it touches, then one relationship and what it links. Colour carries two things at once — where a term came from, and where it is in its life — so a deprecated imported term still reads as imported.

Discovered structures a shape that recurred, not a class it guessed

When the same four facts keep arriving together — who bought what, for how much, on which order — that is a structure, not four loose properties. Skema proposes it as one: the participants, the qualifiers that describe the relationship rather than either end of it, and the count of observations behind each. You name it. A recurrence cannot tell you whether it is a Purchase, an OrderLine or a Transaction, and the system does not pretend otherwise.

Schema Explorer every term, by birth domain

Every governed term, grouped by the domain it was born in — including the orphan properties a graph view cannot draw.

Semantic search yours and the standards together

Search your schema and the open vocabularies together, so reuse is checked before a new URI is ever minted.

Ask the graph answers that cite their decision

Ask what a term means, who decided it, what was rejected and what depends on it. Every answer cites the proposal it came from — and when the record cannot support an answer, it says so instead of producing a confident near-miss.

03govern

Keep it honest

Duplicate detection scored, then handed to people

Overlap scored across namespaces, then handed to the two people who introduced the colliding terms. The machine asserts a candidate link; consolidation is always a human act.

Competency tests unit tests for meaning

Unit tests for meaning, in raw SPARQL when you need it. Assert what your graph must be able to answer and see which proposals would break it. A test is advisory until an owner promotes it to a gate.

Improve and retire thin terms, dead terms

One screen for the two jobs nobody schedules: an agent drafts better descriptions for terms whose definition is thin, and assesses a term you suspect is dead. Deprecation, never deletion — the term is marked and its address keeps working, because something out there still cites it. Both produce ordinary proposals that need the ordinary signatures.

A versioned matching model changed on purpose, not on upgrade

What decides that two terms might be duplicates is a model, and models change. A new one is built alongside the old one and compared on the only thing that matters — the merges it would newly propose, and the ones it would stop proposing. Those two are never averaged into a score: missing a duplicate is recoverable, and merging two things that were not the same is not.

Every change, and what it affects who contributed it, and how far it reaches

Pick any change and the graph becomes a lens on it: what it added, removed or modified; who raised it and who signed it; and what depends on the terms it touched, one hop, two, three. Impact is counted from the graph’s own relationships — nothing is nominated by hand, and sharing a parent is not the same as being affected. Select a concept instead and you get the reverse: the changes that made it what it is.

Definition audit trail who decided, and what lost

Per term: who defined it, why, on what precedent — and which competing definitions were rejected. Exportable.

04release

Hand it on

Versioned releases cut, promote, roll back

Cut a release, promote it to production, roll back. Consumers pin a version; drift is reported, never hidden.

A workspace per person own store, own namespace

Sign up and get your own schema, queue and decision log — separate storage, and its own namespace beneath the deployment’s, so nothing you mint while you are learning can ever collide with what your organisation governs.

What it is all for

Ask the graph. Then check the answer.

Nobody wants an ontology. They want an answer they can put in front of an auditor without flinching.

citedEvery answer has a record.

Not a confidence score — the proposal id, the reviewer, the date, and the reason they gave. You can open the decision and read it.

groundedNo record, no claim.

When the record does not support a claim, it says which part is missing and why. It never assembles a confident near-miss out of what it happens to have.

reconstructedNo generated prose.

Every sentence is built from values read out of the record. There is no path by which this can state something your schema does not contain.

What you ship

One reviewed source. Five generated surfaces.

Govern the term once. Every surface is that same decision, recompiled.

What it solves

What goes wrong with a schema, and what stops it here.

Every line is a sentence teams say about the model they already have, and the mechanism that answers it. Prevented and recoverable are not the same promise.

“Someone changed a term and we found out from a broken dashboard.” blast-radius analysis prevented Downstream terms, dependent queries and recorded facts, shown before anyone approves.

Every proposed change shows what it touches — downstream terms, the queries that depend on them, the facts already recorded against them — before anyone approves it. Reviewers see the blast radius on the same screen as the verdict button.

“We cannot prove who approved this change.” signed decisions provable Two signatures, enforced on the store itself, written to an append-only chain.

Nothing enters the graph without two people signing, and that rule lives on the store itself rather than in a workflow someone can route around. Every applied change is written to a signed, append-only chain. The proof is a record, not a recollection.

“Our ontology team is three people and a backlog of four hundred requests.” schema drafting faster Skema drafts; your people decide. Every decision sharpens the next draft.

Skema drafts the change — new types, properties, merges, safe retirements — already validated, already diffed, already scored. Your people stop authoring and start deciding, and every decision they make sharpens the next draft.

“We have ten thousand documents and no schema.” source traceability traceable Every quoted phrase traced to the page it is really on.

Point it at the pile. Terms come out with every quoted phrase traced to the page it is really on, and an obligation is recorded only where the text says must — never where it says should. You correct the reading before anything is drafted from it.

“We have a knowledge graph. Nobody outside the data team has ever seen it.” the schema canvas visible A screen in the product, not an export. Click a term, get the decision that put it there.

The graph is a screen in the product, not an export you open in something else. Your types, the properties that link them, what each one inherits — laid out and navigable. Click a term and you get what connects to it, what depends on it, and the decision that put it there. The people who argue about what “customer” means can finally look at the same picture while they argue.

“Answering one question about our own data takes a week and a data engineer.” graph-backed answers answerable An answer with its evidence attached, and the population it was drawn from.

Ask the graph in the product and get an answer with the evidence attached — back to the row, or to the sentence in the document it was read from. Every answer states the population it was drawn from and what it does not cover: “3 of the 12 we know about”, never a bare 3 that reads like the whole truth.

“Scanned paper is half our archive.” marked transcription traceable Transcriptions marked as transcriptions; a page read badly is refused, not guessed.

Pages with no text layer are transcribed and clearly marked as transcriptions rather than as the document’s own words, and a page read badly is refused instead of guessed at — a plausible mis-transcription is worse than a blank, because only one of them is quotable.

“The model invented a property that does not exist.” schema-bound extraction prevented A model never writes an identifier. The schema decides whether the property exists.

It cannot. A model never writes an identifier here: it names a property in ordinary words and the schema decides whether that property exists. Every quote is checked back against the source text before it counts as anything.

“Half the team wants to experiment and we cannot let them near the real schema.” namespace isolation isolated Own store, own queue, own namespace — a constraint, not a filter to remember.

Each person signs up and gets their own workspace — own store, own review queue, own decision log — minting under its own namespace beneath yours. Not a filter someone has to remember to apply: two workspaces cannot be pointed at the same namespace at all, because identifiers here are permanent and that collision could never be undone.

“Downstream teams break every time we publish.” versioned releases stable Releases are versioned and hashed; consumers pin the version they built against.

Releases are versioned and hashed, and consumers pin the version they built against. A mismatch is reported to them; it does not arrive silently as a changed meaning under a name that stayed the same.

“Prove this record was not edited after the fact.” external checkpoints provable Checkpoints published somewhere the deployment itself cannot rewrite.

The change log is a signed chain, and checkpoints are published somewhere the deployment itself cannot rewrite — so the proof does not depend on trusting the machine that holds the data, which is the only kind of proof an auditor accepts.

“Legal needs a person’s data erased. Your log is signed and append-only.” provenance-aware erasure erasable The signed chain carries no person; the decision log redacts freely.

Both are true and they never touch. The signed chain covers four fields — an identifier, a timestamp, and two schema diffs — and none of them can carry a person; quoted source text lives in the decision log, which redacts freely. So erasure does not fight the tamper-evidence, and we can show you exactly where the boundary is rather than asking you to take it on trust.

The harder questions

What happens when something has already gone wrong.

Recovery, isolation, erasure, and who can read what. Every line is a mechanism you can run rather than an assurance to take on trust.

“We published a release with a wrong definition in it.” Marked unsafe, subscribers notified, reinstatable — and nothing is deleted. reversible

Recall it. The release is marked unsafe, the consumers who subscribed are notified, and if it turns out to have been fine you reinstate it — every step of that is on the record. Nothing is deleted and no version number is quietly reused.

“We tightened a rule and the old data silently vanished.” Invalidated facts are quarantined with the reason, not dropped. recoverable

Facts a schema change would invalidate are quarantined with the reason, not dropped. They sit somewhere you can look at them and decide, because a tightened rule is sometimes the rule that is wrong.

“Is Acme Corp the same company as ACME Ltd?” Scored, shown with what they were matched on, and resolvable again later. reversible

Candidates are scored and shown to you with what they were matched on. The machine proposes; a person resolves — and an entity can be unresolved again later, because merges made on partial information are exactly the ones you will want back.

“We are not sending our customer data to a model.” Spreadsheets and JSON are profiled deterministically. No model reads them. private

Your spreadsheets and JSON are profiled deterministically — column types, cardinality, patterns — and no model reads them at all. Models are used where language is genuinely the problem: reading prose, drafting a definition, arguing against a proposal. And a model can never write an identifier into your schema in any case.

“What happens when you lose the server?” Backups restored into an isolated copy and compared graph-to-graph, on a schedule. measured

Backups are restored into an isolated copy and compared graph-to-graph, on a schedule, and the results are published including the failures. The change log ships off the machine continuously, so the answer to how much would we lose is minutes and is measured rather than estimated.

“Who at your company can read our data?” Time-boxed, tied to a named person here and a named approver at your end. visible

Hosted by us means we can — the system reasons over your text, so it cannot be encrypted away and anyone claiming otherwise is selling something. So access is time-boxed, tied to a named person here and a named approver at your end, and written to a record you read on your own screen. Or run it in your own cloud and the question does not arise.

“How do we know our data is not mixed with another customer’s?” One deployment per customer — separate process, separate disk, separate namespace. isolated

One deployment per customer — separate process, separate disk, separate namespace. Not a filter in a query that somebody has to remember to write. Two deployments cannot even be pointed at the same namespace: identifiers are permanent, so that collision could never be undone, and it is refused by a constraint.

“What does the graph not know?” Coverage names the properties nothing has ever been recorded against. measured

Coverage names the properties nothing has ever been recorded against. Deliberately not a single percentage: one number averages a property nobody has populated with one that is complete, and hides exactly the gap you were asking about.

two more
“A bulk import flooded us with rubbish once. Never again.” The system samples its own work and suspends its authority below the floor. self-limiting

One decision can admit thousands of rows, so the decision is audited: the system draws its own sample, reports precision as a lower bound rather than a flattering ratio, and suspends its own authority when it drops below the floor. Only a person restores it.

“Two of our engineers both took over during the last outage.” Taking over is a decision someone signs. The machine replaced refuses to start. prevented

Taking over is a decision someone signs, with a reason. A machine that has been replaced refuses to start rather than quietly becoming the second one writing — because two writers here would not collide noisily, they would produce two histories that each look valid and disagree.

Start with one domain. Govern it properly.

Point it at what you already have — a spreadsheet, a contract, an API payload, a scanned page, an ontology. If the first proposals tell you nothing about your own data that you did not know, nothing else here matters.

Read how it works

Nothing to install. Start with the worked example, then bring your own files when you are ready.Sign up and your workspace stays separate — its own storage, its own namespace, visible to nobody else.

Governed schema development for knowledge graphs Run it in your own cloud, or on-premise, or let us host it.
SkemaSchema governance