KF-1000 · Knowledge Foundry Canon

The Foundational Principles of Governed Knowledge Systems

Canon · Draft · v0.1 · 22 min read

Principle  →  Method  →  Architecture  →  Implementation

Why a Canon?

Engineering disciplines are organised around enduring principles that remain valid even as methods, technologies and implementations change. Mechanical engineering outlived the steam engine. Software engineering outlived the languages it was first written in. The principles endure because they describe obligations, not instruments.

Knowledge engineering adopts the same structure. Its tools — expert systems, ontologies, knowledge graphs, foundation models — have already turned over several times, and will again. What does not turn over is the set of obligations a system incurs the moment it holds knowledge on behalf of people who will act on it.

This document states those obligations. It is a Canon, not a manual. The Literature Landscape is where the discipline weighs evidence and persuades; the Canon is where it legislates. Everything that follows is written to be inherited unchanged by the methods, architectures and implementations built beneath it, and to remain true long after any of them is replaced.

The Purpose of the Discipline

Every mature discipline has a single sentence that explains why it exists — medicine’s first, do no harm, accounting’s true and fair view. Knowledge engineering has one too:

The purpose of knowledge engineering is to preserve, improve and govern the evolution of justified knowledge so that it remains trustworthy across time, institutions and computational modalities.

Every principle in this Canon serves that sentence. A statement that does not serve it does not belong here.

Purpose

These principles define the intellectual foundations of governed knowledge systemsGoverned knowledge system — a socio-technical system that holds operational knowledge objects and governs their transition from one justified state to another across modalities (KF-1001). Vocabulary →. Knowledge Foundry is one methodology that adopts them; it is not their source, and they do not depend on it.

The Canon derives the principles that any governed knowledge system must satisfy — regardless of implementation technology, organisational setting, or computational modality. Subsequent methodology, architecture and implementation documents inherit them rather than redefining them.

A principle earns its place here only if it is true of the discipline, not merely of one methodology. The test is stated in The Discipline and Its Four Levels and applied to every principle that follows.

Relationship to the Literature Landscape

KF-L001 answered one question: What does the literature establish? The Canon answers a different one: What design principles necessarily follow from that evidence?

The Literature Landscape is the evidential authority; the Canon converts settled evidence into obligation. No new literature is introduced. Where a principle is grounded in the Landscape, its derivation is cited by chapter and by Landscape Proposition (L-P1–L-P6), Proposition B01, Proposition C01, the six Governance PrimitivesGovernance Primitive — one of the six operations by which warrant is conferred: evidence, authority, provenance, validation, versioning, reversibility (KF-1104). Vocabulary →, or the requirements register (R1–R10). The Canon adds no evidence of its own.

The Discipline and Its Four Levels

A mature engineering discipline separates what is always true from what is one way of acting on that truth. Knowledge Foundry adopts four levels. Each inherits from the one above; none may masquerade as another.

The worked example that fixes the boundaries:

The Canon Admission Test

Every candidate principle is admitted only if it survives two questions:

1. Would this still be true if Knowledge Foundry ceased to exist?

2. Would this still be true fifty years from now, even if today’s AI models were obsolete?

If either answer is no — if the statement presupposes a particular method, structure, product, deployment or generation of technology — it belongs below the line, in the Methodology, the Reference Architecture, or an Implementation. The two questions guard the two ways a statement fails to be constitutional: by belonging to one project, or by belonging to one era. This test is what separates a discipline from a framework. It is applied to each of the ten principles, every one of which closes with a Below the line note recording what it excludes.

Each principle is derived primarily from a chapter of the Landscape, but no principle is a summary of a chapter. A summary restates evidence; a principle states an obligation the evidence makes unavoidable. Several principles draw on the whole Landscape, and the later ones arise only when the chapters are read together.

How to Read This Canon

Part I defines the object and the system. Part II states the invariants that make principles necessary. Part III states the ten principles. Part IV draws their design consequences without descending into method. Part V is the bridge to KF-2000. Read in order, the Canon moves from what a governed knowledge system is to what its existence obliges — and stops where method begins.

Part I · Foundations

KF-1001 · The Nature of Governed Knowledge Systems

Purpose. Establish the central object of the discipline and define what a governed knowledge system is.

The central object

Knowledge systems never reach past their representations to touch knowledge itself (Proposition B01; L-P1). What they hold and change is the Operational Knowledge Object: a versioned representation together with its attached evidence, justification and acceptance-state. It is the concrete instance of the abstract Conceptual Object — representation → claim → evidence → justification → acceptance — that B01 defines.

The discipline takes the Operational Knowledge Object, not “knowledge,” as its unit of design. This is precision, not modesty. A system cannot engineer truth, because truth is not inspectable. It engineers the object that stands in for knowledge and carries the warrant a community attaches to it.

Formal definition

A governed knowledge system is a socio-technical system that holds operational knowledge objects and governs their transition from one justified state to another — across human, symbolic, parametric and hybrid modalities — so that warranted claims remain available, revisable and trustworthy over time.

Four terms in this definition are canonical and are used throughout the programme:

• Governed evolution — the controlled transition of a knowledge system from one justified state to another; the discipline’s characteristic operation, and the persistent challenge the Landscape identifies (L-P6).
• Human–machine system — the system boundary includes the people and institutions that create, authorise and depend on its knowledge. They are inside the system, not external to it.
• Knowledge infrastructure — knowledge treated as durable, shared, continuously maintained substrate rather than as a bounded artefact or a project deliverable.
• Computational modality — the cross-cutting axis (Human · Symbolic · Parametric · Hybrid) along which the system’s operations are redistributed but never removed (L-P5).

Deliverable. The definition above is the discipline’s fixed point. Every principle in Part III is a property of the system so defined; every method in KF-2000 is a way of realising one of those properties.

Part II · Constitutional InvariantsConstitutional invariant — one of the five properties whose loss would make a system cease to be a governed knowledge system: inspectability, justification, provenance, governed evolution, human accountability (KF-1050). Vocabulary →

KF-1050 · What Never Changes

Technology changes. Methods change. Architectures change. Products change. Institutions change. Yet some obligations remain invariant across all of them, and it is these invariants that make principles necessary. The ten principles of Part III are not free postulates; each one operationalises an invariant named here. This chapter is the Canon’s preamble: it states the properties that any governed knowledge system must exhibit in every era, before any principle prescribes how.

Five invariants hold.

Inspectability. Whatever a knowledge system holds must be capable of being examined. A system whose contents cannot be inspected cannot be justified, explained, audited or corrected. Inspectability is prior to all of these; it is the condition that makes governance possible at all.

Justification. A claim held as knowledge must carry the grounds on which it is held. Warrant, not mere assertion, is what distinguishes knowledge from information. A system may hold much that is unjustified, but it may not call that knowledge.

Provenance. The history of a claim — where it came from, how it changed, on whose authority — must be recoverable. A present state that cannot be traced to the transitions that produced it cannot be trusted, however plausible it appears.

Governed evolution. Knowledge changes, and the change must be controlled rather than incidental. A system in which states can shift without proposal, evidence, authority and release does not hold knowledge; it accumulates content.

Human accountability. Some identifiable person or body must answer for what a system accepts as knowledge. Operations may be distributed across people and machines, but accountability may not be discharged into a substrate. There is always someone who is answerable.

These five are not yet the principles. They are the properties whose loss would make a system cease to be a governed knowledge system. The principles that follow give them force: they state, for each invariant, the obligation it imposes on anyone who would build such a system. An invariant answers what must always hold; a principle answers what that obligates us to do.

Part III · The Canonical PrinciplesCanonical Principle — an enduring obligation true of any governed knowledge system, admitted only if it survives the two-question test (KF-1000 Part III). Vocabulary →

The ten principles are the constitutional core of the discipline. Each is stated as an obligation, derived from the Landscape, shown to survive both questions of the Admission Test, and closed with the line it must not cross. They are numbered I–X and carried under document IDs KF-1101–KF-1110 so that later documents can cite a principle in two characters.

KF-1101 · Principle I — Knowledge systems govern operational knowledge objects, never knowledge itself

Derived primarily from B01 (Proposition B01; L-P1; the Inspectable Objects Principle). Invariant: inspectability.

A knowledge system does not contain knowledge. It contains representations, the evidence and justification attached to them, and their acceptance-state under some authority. “Knowledge” is the name a community gives to an operational knowledge object that has cleared those tests. Truth and the tacit remainder lie permanently outside the system’s reach.

This principle fixes the object every other principle acts upon. It dissolves a standing confusion: whether a system “really contains knowledge” is mis-posed. No system does, and none needs to. What a system holds, warrants, governs and revises is the operational knowledge object.

Admission Test. True of every knowledge system ever built, from a 1970s rule base to a foundation model, and true of any yet to be built. Passes both questions.

Below the line (not Canon): how an operational knowledge object is represented is method; the store that holds it is architecture; a particular deployment is implementation. The Canon fixes only that the object — not knowledge — is what is governed.

KF-1102 · Principle II — A knowledge system is engineered as a lifecycle, not as an artefact

Derived primarily from B02 (L-P2; the expanding object of engineering). Invariant: governed evolution.

The object of knowledge engineering has widened, across five decades, from expert reasoning to whole hybrid systems. With that widening, the engineering task moved from constructing an artefact once to governing its continuous change. To engineer a knowledge system is to engineer its lifecycle: the unit of engineering is the transition, not the finished representation.

Continuous evolution is not a feature added to a built artefact. It is the thing being built. A method designed for one-off, up-front construction contradicts this principle.

Admission Test. Any system that holds knowledge over time faces change whether or not it is designed for it; the obligation to engineer that change is independent of any technology or project. Passes both questions.

Below the line (not Canon): which lifecycle stages to define, and how to move between them, is method; the pipelines and stores that realise them are architecture.

KF-1103 · Principle III — Knowledge becomes enduring capability only through collective authorisation

Derived primarily from B03 (L-P3). Invariant: human accountability.

Knowledge that endures is not a possession of an individual or a property of a machine. It is a capability of a collective, held in place by authorisation, legitimation and stewardship. Acceptance — the act by which a community with authority certifies a claim as settled — is what turns a well-justified representation into “what we know.”

A governed knowledge system is socio-technical by necessity, not by preference. Its boundary includes the people and institutions that warrant its claims. A system that treats authorisation as external to itself has mislocated the source of the durability it depends on.

Admission Test. The collective and authorised character of enduring knowledge holds across organisations, disciplines and centuries. Passes both questions.

Below the line (not Canon): which roles hold which decision rights, and through what workflow authorisation flows, is method and architecture; who staffs those roles is implementation.

KF-1104 · Principle IV — Governance is constitutive of knowledge, not supervisory over it

Derived primarily from B04 (L-P4; the six Governance Primitives). Invariant: justification.

Governance is not a control layer placed on top of finished knowledge. It is what makes a representation count as knowledge at all. Strip away evidence, authority, provenance, validation, versioning and reversibility — the six Governance Primitives — and what remains is information, not knowledge. The primitives are the operations by which warrant is conferred; warrant is what distinguishes the two.

This inverts the intuition that governance constrains an otherwise-complete asset. Governance is the asset’s condition of existence. Stated at full strength: a knowledge state is only as legitimate as the governance that produced it.

Admission Test. The dependence of knowledge-status on warrant, and of warrant on governance, is a claim about knowledge, not about any methodology or era. Passes both questions.

Below the line (not Canon): how each primitive is instantiated — the shape of a validation gate, the format of a provenance record — is method and architecture. The primitives themselves are constitutional.

KF-1105 · Principle V — Computational modality redistributes epistemic labour but never discharges epistemic obligation

Derived primarily from B05 (L-P5; “the substrate changes; the epistemic obligations do not”). Invariant: justification.

A new computational substrate — parametric, agentic, hybrid — changes where knowledge resides and who or what performs each operation. It does not change the obligations to justify, authorise, preserve and govern the resulting claims. Foundation models introduced a new representation, not a new epistemology; they relocated capability across the symbolic–parametric boundary rather than abolishing it.

This principle forbids the recurring error of granting a modality an epistemic discount — of treating a fluent generated answer as if it carried warrant it has not earned. Opacity of substrate is not a licence for opacity of obligation.

Admission Test. The principle is written about any substrate, not today’s. It survives the obsolescence of current models precisely because it refuses to attach obligation to a technology. Passes both questions — and Question 2 is its point.

Below the line (not Canon): how to honour an obligation in a difficult modality — grounding generation in retrieved evidence, reconstructing provenance for a model weight — is method; the model and index that do so are architecture.

KF-1106 · Principle VI — A knowledge system is irreducibly engineered, collective and governed at once

Derived primarily from C01 (Proposition C01; the integrated reference model). Invariant: governed evolution.

Engineering, capability and governance are not three kinds of knowledge system. They are three operations that every knowledge system undergoes simultaneously on a single object. No system is only engineered, only collective, or only governed. To hold any one of these steady while working only on another — the division of labour the Landscape found across the literature — is to describe part of a system, never the whole.

The deficiency the Landscape identified was therefore one of coordination: the literature explains each operation in isolation and does not explain their coordination over the lifecycle of one governed object (Proposition C01). This principle makes coordination a first-class obligation.

Admission Test. The irreducibility of the three operations is a structural fact about knowledge systems, independent of who coordinates them or when. Passes both questions.

Below the line (not Canon): the coordination mechanism — how a single change propagates across engineering, capability and governance — is the central method of KF-2000. The Canon fixes only that the three are inseparable.

KF-1107 · Principle VII — Trust in a knowledge system is a property of its transitions over time, not of its state

Derived from B04 and C01 (L-P6; the records-continuum and provenance traditions). Invariant: provenance.

A knowledge system is not trustworthy because of what it holds at an instant. It is trustworthy because the history of how it came to hold it can itself be trusted. Trust is carried by transitions — by the appraisal, provenance, authenticity and controlled release that survive each change — not by any snapshot. Change is constitutive of a knowledge system; the question is whether trust survives it.

This is the temporal principle. It obliges a system to treat its own past as evidence: to retain, reconstruct and authenticate prior states, so that a present claim can be traced to the transitions that produced it.

Admission Test. That trustworthiness-over-time is a property of change rather than of state holds for any records system or knowledge system, in any era. Passes both questions.

Below the line (not Canon): retention windows, versioning schemes and authenticity mechanisms are method and architecture; how long an institution keeps a given state is implementation.

KF-1108 · Principle VIII — No knowledge state is legitimate without an inspectable justification for how it was reached

Derived from B01 and B04 (Proposition B01; Evidence/Justification and Provenance primitives; R2, R4, R6). Invariants: justification, inspectability.

Every transition of an operational knowledge object carries its justification: the evidence, reasoning and authority under which the new state was accepted. Acceptance without recorded, inspectable justification is assertion, not knowledge. A system can engineer justification even though it cannot engineer truth — justification is the richest thing it can govern — and so justification, not truth, is the standard to which every transition is held.

Principle VIII is the per-transition consequence of Principle IV: if governance is constitutive, each individual change must bear the warrant that governance confers. A knowledge state whose justification cannot be inspected has no standing, however plausible it appears.

Admission Test. The requirement that legitimate knowledge carry inspectable justification is epistemic, not methodological, and not tied to any generation of tools. Passes both questions.

Below the line (not Canon): the structure of a justification record and the interface that exposes it are method and architecture.

KF-1109 · Principle IX — A knowledge system must remain explainable irrespective of the modality in which its knowledge resides

Derived from B02, B05 and C01 (the explanation imperative; the parametric opacity findings). Invariants: inspectability, human accountability.

The demand that a system explain its conclusions is one of the discipline’s oldest commitments, and it does not lapse when knowledge moves into an opaque substrate. Where the substrate cannot be read directly — as with parametric knowledge — explainability becomes an obligation the system meets by design around the substrate, not an excuse the substrate provides. Explainability is owed by the system, not by the component.

The principle sets a standard the hardest modality must still meet. A system may hold knowledge it cannot introspect; it may not therefore hold knowledge it cannot account for.

Admission Test. Explainability as an obligation of knowledge systems predates today’s models and will outlast them; the techniques will change, the obligation will not. Passes both questions — and Question 2 is its point.

Below the line (not Canon): the techniques that deliver explanation — retrieval grounding, citation, surrogate inspection, neuro-symbolic structure — are method and architecture, and will change; the obligation will not.

KF-1110 · Principle X — A knowledge system is designed for governed evolution, not for preservation

Derived from the entire Landscape (L-P2, L-P6; Proposition C01). Invariant: governed evolution.

The default condition of knowledge is change. A governed knowledge system is designed, from the first, for governed evolution. Preservation is a special, bounded case of evolution — the decision to hold a state trustworthy across time — not the system’s natural resting point. A design that treats stability as the norm and change as the exception has the discipline backwards.

This principle gathers the other nine into a posture. The object is governed (I, IV); its engineering is a lifecycle (II); its durability is collective (III); its obligations survive any substrate (V, IX); its coordination is inseparable (VI); its trust and its legitimacy live in its transitions (VII, VIII). What persists through every iteration is not knowledge itself, but the governed transition from one accepted state to the next.

Admission Test. That knowledge systems face continuous change, and are best designed for it, is true of the domain irrespective of any methodology or era. Passes both questions.

Below the line (not Canon): the mechanics of a knowledge release — quality gates, rollback, promotion between states — are the core method of KF-2000; their components are architecture; a running release cadence is implementation.

Part IV · Design Consequences

The principles are not methods, but they are not inert: they constrain the space of admissible methods, architectures and implementations. This part records those constraints without crossing into method. Each consequence is a boundary on KF-2000 and below.

KF-1201 · Engineering Consequences

The unit of engineering is the transition (II) and the object is the operational knowledge object (I). Governance cannot be bolted on after construction: versioning, provenance and justification are first-class from the first design increment (IV, VII, VIII). Representations must be inspectable, because a representation that cannot be inspected cannot be justified or explained (VIII, IX). Because the three operations are inseparable (VI), an engineering method that optimises one in isolation — a pipeline that builds without governing, or governs without accounting for modality — is inadmissible.

KF-1202 · Governance Consequences

All six Governance Primitives are present, or the system governs incompletely (IV). Authority is explicit and remains human, because legitimation is a collective act (III) and redistribution of labour across modalities does not redistribute accountability (V). Appraisal — deciding what to promote, retain and retire — is part of governance, not separate from it, because trust is a property of transitions over time (VII). Governance that only records change, without adjudicating whether a change should be promoted into an accepted state, satisfies none of these principles.

KF-1203 · AI Consequences

Parametric and agentic knowledge is subject to exactly the same obligations as symbolic knowledge (V). The substrate makes some obligations harder to honour — provenance and reversibility above all — but does not lift them. A generative core is engineered into a governed system, grounded in inspectable evidence, and made explainable by design around its opacity (VIII, IX). Autonomous agents may perform operations, but the authority to accept a claim into the knowledge state remains human (III, V). Any AI-native method that treats fluency as warrant, or model turnover as acceptable knowledge loss, violates the Canon.

KF-1204 · Institutional Consequences

Knowledge is infrastructure (KF-1001): an institution’s knowledge is a shared, maintained, evolving asset, not a collection of documents or a set of model weights. The organisation and its decision rights are inside the system (III). Continuity of collective memory survives personnel change and model change alike (VII, X). Institutions hold identifiable authority for knowledge transitions, and do not allow knowledge that lives only in a substitutable substrate to become knowledge they cannot guarantee they still possess.

Part V · Transition to Methodology

KF-1301 · From Principles to Methods

The Canon ends where method begins. Its final task is to hand a clean set of obligations to KF-2000 and to fix, once, the rule that governs the handoff.

Each principle becomes a demand on method without dictating the method:

KF-2000 proposes methods that discharge these obligations; KF-3000 specifies architectures that realise those methods; KF-4000 demonstrates them in a reference implementation. The direction of inheritance is strict and one-way: a lower level may choose how to satisfy a higher one, but may never revise it. A method that cannot be reconciled with a principle yields to the principle — or the principle is challenged openly, here in the Canon, on the evidence of the Landscape, and not quietly overridden in practice.

Relationship to Subsequent Documents

• KF-L001 — Literature Landscape establishes the evidence.
• KF-1000 — Canon establishes the principles.
• KF-2000 — Methodology defines the methods.
• KF-3000 — Reference Architecture specifies design patterns and system components.
• KF-4000 — Knowledge Operating System provides a reference implementation.
• Domain deployments — such as a university course domain, a professional-body knowledge domain, or an institutional decision system — are domain-specific instantiations of the Knowledge Operating System.

Each document inherits, rather than revises, the Canon. A change to a principle is a constitutional amendment, made against the Landscape’s evidence and propagated downward; a change to a method, architecture or implementation is ordinary work that leaves the Canon untouched.

Closing Statement

The Literature Landscape demonstrated that the constituent elements of governed knowledge systems already exist across multiple mature traditions. The Canon states the enduring principles that integrate those elements into a coherent discipline.

It is the constitutional foundation from which methodology, architecture and implementation derive. Its authority rests on a single discipline: every statement it contains would remain true if Knowledge Foundry itself were to disappear, and would remain true fifty years from now with today’s technologies long replaced. That is what makes it a Canon rather than a framework — and what the work built upon it must never be allowed to erode.