Your data model is a shared language. Govern it like one.
Every schema change arrives as a proposal — its rationale, its blast radius and its provenance attached, validated by machines and signed by at least two people. Then it reads your documents into the graph those types describe, and every answer cites the line it came from.
This is the history your schema already has. Every column in it is recoverable except the first one, and the first one is the only column that matters.
A contract PDF, a spreadsheet of orders, an API payload, a product catalogue and somebody’s meeting notes. Five sources, five formats, no shared vocabulary between them.
Structured files are profiled deterministically; prose is read by the extraction agent. Every candidate concept keeps a pointer back to the evidence that produced it.
Concepts are matched against your schema and the open vocabularies before anything is minted. What survives becomes a proposal with its relationships attached.
Two people sign each change. What remains is a governed ontology — versioned, provenance-carrying, and exportable in five formats.
Skema finds repeated structure in evidence, then asks people to govern what it found.
Piyush joined Acme as a senior engineer and now leads the Delhi team.
Evidence can move after a decision is made.
The decision does not disappear with it.
The evidence it was admitted on is still the evidence.
Same claim. Different evidence.
An open identity question remains.
Support fell below the bar.
The rule that admitted it is no longer the rule in force.
Evidence can move. Governance does not pretend it didn’t.
The machine reports the change. Unsigning is a human act, and it stays one — a claim two people signed is never withdrawn by a recount.
Evidence moves. The fact still has to account for itself — who it is about, why it is believed, where it is true, and how it can genuinely go.
Identity is established once. Evidence does not drift it.
Every belief has a chain, and the chain is rebuilt, never stored.
Scope travels on the fact, not in a filter somebody has to remember.
Deleting the source is not deletion.
A fact without its history is only half a fact.
Provenance is what makes an explanation possible. Erasure is what keeps that provenance accountable.
Every view answers a different question. Start with inheritance, focus a class, inspect a relationship.
Understand the shape you have. Then decide what belongs in it.
An identifier here never moves once it exists. So importing shows you the plan first, and mints nothing until you say so.
Spelling and meaning are asked separately: labels are compared here, and the index is asked whether a term you already have means the same thing.
The model drafts. Machines validate. People decide. The order never changes.
CSV and JSON are profiled deterministically. No model reads your data.
You fix the extraction before anything is drafted.
Your schema is searched first. Minting a new URI is the last resort.
Four tiers run before a human is involved. Failures never reach the queue.
At least two signatures, from two different people. Never one.
The term enters the governed schema with its full decision record attached.
Accepted decisions become precedents, cited back to the drafting agent.
Before a human decides, the system has already traced what changes, what breaks, and what needs attention.
A duplicate opens a conversation, not a ticket — the machine scores the match and names the two people who introduced each term, and nothing is ever auto-deleted.
Every decision becomes context for the next one.
A tool that has watched two hundred of your decisions is not the same product as the one you installed.
Six months of decisions is not a log. It is a vocabulary.
The log is yours and it exports. Six months of “why we said no” is not something a replacement can be handed — and we would rather say that plainly than have you discover it.
Every one of these is a surface in the workspace today.
A PDF is split on its own headings and pages, not a fixed window. Each quoted phrase carries the page it came from, so every proposal traces back to a sentence you can go and read.
Read prose into the graph your schema describes. Every assertion quotes the sentence it came from, and a policy audit checks them against the rules you govern.
schema.org, FOAF, DCTerms and SKOS ship with it, and you can register your own for the same governed import path. Take a vocabulary whole, or open it and import the dozen terms you actually want. Every import shows its plan first: what it would mint, what you already have, and where each term would attach.
Three levels, each building a different graph: inheritance alone, then one class and what it touches, then one relationship and what it links. Colour carries two things at once — where a term came from, and where it is in its life — so a deprecated imported term still reads as imported.
When the same four facts keep arriving together — who bought what, for how much, on which order — that is a structure, not four loose properties. Skema proposes it as one: the participants, the qualifiers that describe the relationship rather than either end of it, and the count of observations behind each. You name it. A recurrence cannot tell you whether it is a Purchase, an OrderLine or a Transaction, and the system does not pretend otherwise.
Every governed term, grouped by the domain it was born in — including the orphan properties a graph view cannot draw.
Search your schema and the open vocabularies together, so reuse is checked before a new URI is ever minted.
Ask what a term means, who decided it, what was rejected and what depends on it. Every answer cites the proposal it came from — and when the record cannot support an answer, it says so instead of producing a confident near-miss.
Overlap scored across namespaces, then handed to the two people who introduced the colliding terms. The machine asserts a candidate link; consolidation is always a human act.
Unit tests for meaning, in raw SPARQL when you need it. Assert what your graph must be able to answer and see which proposals would break it. A test is advisory until an owner promotes it to a gate.
One screen for the two jobs nobody schedules: an agent drafts better descriptions for terms whose definition is thin, and assesses a term you suspect is dead. Deprecation, never deletion — the term is marked and its address keeps working, because something out there still cites it. Both produce ordinary proposals that need the ordinary signatures.
What decides that two terms might be duplicates is a model, and models change. A new one is built alongside the old one and compared on the only thing that matters — the merges it would newly propose, and the ones it would stop proposing. Those two are never averaged into a score: missing a duplicate is recoverable, and merging two things that were not the same is not.
Pick any change and the graph becomes a lens on it: what it added, removed or modified; who raised it and who signed it; and what depends on the terms it touched, one hop, two, three. Impact is counted from the graph’s own relationships — nothing is nominated by hand, and sharing a parent is not the same as being affected. Select a concept instead and you get the reverse: the changes that made it what it is.
Per term: who defined it, why, on what precedent — and which competing definitions were rejected. Exportable.
Cut a release, promote it to production, roll back. Consumers pin a version; drift is reported, never hidden.
Sign up and get your own schema, queue and decision log — separate storage, and its own namespace beneath the deployment’s, so nothing you mint while you are learning can ever collide with what your organisation governs.
Nobody wants an ontology. They want an answer they can put in front of an auditor without flinching.
Not a confidence score — the proposal id, the reviewer, the date, and the reason they gave. You can open the decision and read it.
When the record does not support a claim, it says which part is missing and why. It never assembles a confident near-miss out of what it happens to have.
Every sentence is built from values read out of the record. There is no path by which this can state something your schema does not contain.
Counterparty was signed off by alice and owner across two stages.
“Finance and legal were minting this separately. Keeping the filed term so the statutory reports and the contracts register agree.”
No rejected alternative is on record for this term, so this answer cannot tell you what else was considered.
Govern the term once. Every surface is that same decision, recompiled.
A party that places orders against a contract.
skema:Customer a owl:Class ; rdfs:label "Customer" ; rdfs:subClassOf skema:Party .
The canonical governed RDF.
generated from Customer · v2.5.0{ "$id": "Customer",
"type": "object",
"required": ["id"] }
Validation at the API boundary.
generated from Customer · v2.5.0interface Customer { id: string; party: Party; }
The model, in your editor.
generated from Customer · v2.5.0type Customer { id: ID! party: Party! }
A type per class, same descriptions.
generated from Customer · v2.5.0### Customer
A party that places orders
against a contract.
For people who never open a .ttl.
generated from Customer · v2.5.0One meaning. Five representations.
None of them can drift, because none of them are written by hand.
Every line is a sentence teams say about the model they already have, and the mechanism that answers it. Prevented and recoverable are not the same promise.
Every proposed change shows what it touches — downstream terms, the queries that depend on them, the facts already recorded against them — before anyone approves it. Reviewers see the blast radius on the same screen as the verdict button.
Nothing enters the graph without two people signing, and that rule lives on the store itself rather than in a workflow someone can route around. Every applied change is written to a signed, append-only chain. The proof is a record, not a recollection.
Skema drafts the change — new types, properties, merges, safe retirements — already validated, already diffed, already scored. Your people stop authoring and start deciding, and every decision they make sharpens the next draft.
Point it at the pile. Terms come out with every quoted phrase traced to the page it is really on, and an obligation is recorded only where the text says must — never where it says should. You correct the reading before anything is drafted from it.
The graph is a screen in the product, not an export you open in something else. Your types, the properties that link them, what each one inherits — laid out and navigable. Click a term and you get what connects to it, what depends on it, and the decision that put it there. The people who argue about what “customer” means can finally look at the same picture while they argue.
Ask the graph in the product and get an answer with the evidence attached — back to the row, or to the sentence in the document it was read from. Every answer states the population it was drawn from and what it does not cover: “3 of the 12 we know about”, never a bare 3 that reads like the whole truth.
Pages with no text layer are transcribed and clearly marked as transcriptions rather than as the document’s own words, and a page read badly is refused instead of guessed at — a plausible mis-transcription is worse than a blank, because only one of them is quotable.
It cannot. A model never writes an identifier here: it names a property in ordinary words and the schema decides whether that property exists. Every quote is checked back against the source text before it counts as anything.
Each person signs up and gets their own workspace — own store, own review queue, own decision log — minting under its own namespace beneath yours. Not a filter someone has to remember to apply: two workspaces cannot be pointed at the same namespace at all, because identifiers here are permanent and that collision could never be undone.
Releases are versioned and hashed, and consumers pin the version they built against. A mismatch is reported to them; it does not arrive silently as a changed meaning under a name that stayed the same.
The change log is a signed chain, and checkpoints are published somewhere the deployment itself cannot rewrite — so the proof does not depend on trusting the machine that holds the data, which is the only kind of proof an auditor accepts.
Both are true and they never touch. The signed chain covers four fields — an identifier, a timestamp, and two schema diffs — and none of them can carry a person; quoted source text lives in the decision log, which redacts freely. So erasure does not fight the tamper-evidence, and we can show you exactly where the boundary is rather than asking you to take it on trust.
Recovery, isolation, erasure, and who can read what. Every line is a mechanism you can run rather than an assurance to take on trust.
Recall it. The release is marked unsafe, the consumers who subscribed are notified, and if it turns out to have been fine you reinstate it — every step of that is on the record. Nothing is deleted and no version number is quietly reused.
Facts a schema change would invalidate are quarantined with the reason, not dropped. They sit somewhere you can look at them and decide, because a tightened rule is sometimes the rule that is wrong.
Candidates are scored and shown to you with what they were matched on. The machine proposes; a person resolves — and an entity can be unresolved again later, because merges made on partial information are exactly the ones you will want back.
Your spreadsheets and JSON are profiled deterministically — column types, cardinality, patterns — and no model reads them at all. Models are used where language is genuinely the problem: reading prose, drafting a definition, arguing against a proposal. And a model can never write an identifier into your schema in any case.
Backups are restored into an isolated copy and compared graph-to-graph, on a schedule, and the results are published including the failures. The change log ships off the machine continuously, so the answer to how much would we lose is minutes and is measured rather than estimated.
Hosted by us means we can — the system reasons over your text, so it cannot be encrypted away and anyone claiming otherwise is selling something. So access is time-boxed, tied to a named person here and a named approver at your end, and written to a record you read on your own screen. Or run it in your own cloud and the question does not arise.
One deployment per customer — separate process, separate disk, separate namespace. Not a filter in a query that somebody has to remember to write. Two deployments cannot even be pointed at the same namespace: identifiers are permanent, so that collision could never be undone, and it is refused by a constraint.
Coverage names the properties nothing has ever been recorded against. Deliberately not a single percentage: one number averages a property nobody has populated with one that is complete, and hides exactly the gap you were asking about.
One decision can admit thousands of rows, so the decision is audited: the system draws its own sample, reports precision as a lower bound rather than a flattering ratio, and suspends its own authority when it drops below the floor. Only a person restores it.
Taking over is a decision someone signs, with a reason. A machine that has been replaced refuses to start rather than quietly becoming the second one writing — because two writers here would not collide noisily, they would produce two histories that each look valid and disagree.
Point it at what you already have — a spreadsheet, a contract, an API payload, a scanned page, an ontology. If the first proposals tell you nothing about your own data that you did not know, nothing else here matters.
Nothing to install. Start with the worked example, then bring your own files when you are ready.Sign up and your workspace stays separate — its own storage, its own namespace, visible to nobody else.
© 2026 Skema. Operated by Norns.