UAIF Schema Specification
Searchable schema documentation covering naming, architecture alignment, profiles, conditional validation, severity fields and compatibility.
Canonical repository publication
The human-readable Schema Specification remains on this website for accessibility, search and normative context. The machine-readable JSON Schema should also be released through an official ODA3 version-controlled repository with immutable tags, checksums, examples, validation tests and release notes.
No approved public GitHub repository was supplied with this website build. A repository link will be added only after ownership, release tag, licence, security review and publication authorization are confirmed.
Downloads and formats
No approved PDF edition was supplied with this build. A PDF link will be added only after publication approval.
Document status and notice
Schema Specification — Publication Candidate TCR-STD-003 | Q2 2026 | Licensed under GAISSF Ecosystem Licence (GEL v1.0) | © 2026 ODA3 Pvt Ltd
Published by ODA3 Institute. This document is the normative machine-readable schema companion to TCR-STD-002 UAIF™ v1.0 Technical Specification.
Status and Authority
The schema is named UAIF™ Schema v1.0. No separate schema-layer brand or trademark is used. TCR-STD-002 is normative for calculation, regulatory trigger logic, conformance, and controlled vocabulary. This schema SHALL conform to TCR-STD-002.
This document contains one normative JSON Schema only. Legacy minimal schemas, duplicate schema blocks, operational filing claims, and generation prompt artifacts have been removed.
Notably Absent
No submitter PII fields; use hashed or external contact references.
No proprietary sector calibration weights.
No STIX translation profile; mapping fields are limited to identifiers such as atlas_technique_id.
No certification or audit authority granted by schema use.
No obsolete EU AI Act incident-reporting proxy references; UAIF uses Article 73 for serious-incident routing assistance.
1. Schema Naming and Versioning
| Item | Normative Value |
|---|---|
| Schema name | UAIF™ Schema v1.0 |
| Document ID | ODA3-2026-06-TCR-STD-003 |
| Schema $id | https://schemas.oda3.org/uaif/core/v1.0/uaif-core-v1.0.json |
| Market-facing version | v1.0 |
| Machine-readable semantic version | 1.0.0, where needed in metadata only |
| Licence | GAISSF Ecosystem Licence (GEL v1.0) |
2. 7-Layer Architecture Alignment
The UAIF Schema follows the 7-layer architecture in TCR-STD-002. L7 AI Control Plane Extensions are merged into L5 and SHALL NOT be represented as a separate conformance layer.
| Layer | Schema Coverage |
|---|---|
| L0 | incident_uuid, reporting_timestamp, reporter_confidence_level, remediation_status, deduplication_hash |
| L1 | root_cause_primary_domain, root_cause_specific_type, root_cause_confidence, exploit_path_description |
| L2 | severity_analytical_score, severity_presentation_score, severity_level, severity_rationale |
| L3 | harm_acute, harm_chronic_proxy, realized_harm_categories, cumulative_bias_index |
| L4 | record_type, linked_vulnerability_id, exposure_duration_hours |
| L5 | ai_system_type, non_adversarial_failure_type, agent_escalation_chain, mcp_endpoint_ids, oauth_pivot_chain, policy_enforcement_point, atlas_technique_id |
| L6 | sector_code, nace_code_actual, naics_code_actual, jurisdiction_country_code, regulatory_obligations, regulatory_trigger |
3. Profile Conformance
| Profile | Field Rule |
|---|---|
| Core | Requires L0, L1, L2, L6 baseline fields and prohibits L3, L4, and L5 fields in the primary payload unless stored under x_extensions. |
| Enterprise | Adds L3 and L4 fields; L5 remains prohibited unless extension profile is selected. |
| Regulatory | Adds extended L6 obligations, regulatory trigger confidence, and human review fields. |
| SOC/SIEM | Adds atlas_technique_id and security tooling references without requiring L3/L5 payload expansion. |
| AI Security Extension | Adds selected L5 control-plane and attack-vector fields. |
4. Normative JSON Schema
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://schemas.oda3.org/uaif/core/v1.0/uaif-core-v1.0.json",
"title": "UAIF Core Profile Schema v1.0",
"type": "object",
"required": [
"incident_uuid",
"incident_title",
"incident_summary",
"reporting_timestamp",
"deduplication_hash",
"remediation_status",
"record_type",
"root_cause_primary_domain",
"root_cause_specific_type",
"sector_code",
"jurisdiction_country_code",
"severity_justification"
],
"properties": {
"incident_uuid": {
"type": "string",
"format": "uuid"
},
"incident_title": {
"type": "string",
"minLength": 5,
"maxLength": 255
},
"incident_summary": {
"type": "string",
"minLength": 20,
"maxLength": 4000
},
"reporting_timestamp": {
"type": "string",
"format": "date-time"
},
"reporter_confidence_level": {
"type": "integer",
"minimum": 1,
"maximum": 5
},
"deduplication_hash": {
"type": "string",
"pattern": "^[a-fA-F0-9]{64}$"
},
"remediation_status": {
"type": "string",
"enum": [
"Detected",
"Investigating",
"Mitigated",
"Resolved"
]
},
"record_type": {
"type": "string",
"enum": [
"Incident",
"Vulnerability",
"Observation"
]
},
"root_cause_primary_domain": {
"type": "string",
"enum": [
"Human",
"System",
"Data",
"External"
]
},
"root_cause_specific_type": {
"type": "string",
"pattern": "^(Adversarial_Attack|Prompt_Injection|Model_Poisoning|Data_Poisoning|RAG_Leakage|Hallucination|Agent_Escalation|Policy_Violation|System_Failure|Human_Error|Supply_Chain_Compromise|Unauthorised_Access|Data_Breach|Denial_of_Service|Misuse|x_[A-Za-z0-9_]+)$"
},
"root_cause_confidence": {
"type": "string",
"enum": [
"LOW",
"MEDIUM",
"HIGH"
]
},
"exploit_path_description": {
"type": "string",
"minLength": 20,
"maxLength": 4000
},
"severity_analytical_score": {
"type": "number",
"minimum": 0.0,
"maximum": 10.0,
"multipleOf": 0.1
},
"severity_presentation_score": {
"type": "number",
"minimum": 0.0,
"maximum": 10.0,
"multipleOf": 0.1
},
"severity_level": {
"type": "integer",
"minimum": 1,
"maximum": 5
},
"severity_justification": {
"type": "string",
"minLength": 20,
"maxLength": 2000
},
"severity_rationale": {
"type": "object",
"required": [
"calibration_status"
],
"properties": {
"dominant_harm": {
"type": "string",
"enum": [
"Physical_Harm",
"Environmental_Harm",
"Security_Integrity",
"Privacy_Violation",
"Financial_Loss",
"Psychological_Harm",
"Property_Damage",
"Reputational_Harm"
]
},
"dominant_weight": {
"type": "number"
},
"secondary_harms": {
"type": "array",
"items": {
"type": "string",
"enum": [
"Physical_Harm",
"Environmental_Harm",
"Security_Integrity",
"Privacy_Violation",
"Financial_Loss",
"Psychological_Harm",
"Property_Damage",
"Reputational_Harm"
]
}
},
"secondary_contribution": {
"type": "number"
},
"context_modifiers_applied": {
"type": "array",
"items": {
"type": "object",
"required": [
"context",
"base_value",
"contribution_factor",
"effective_contribution"
],
"properties": {
"context": {
"type": "string"
},
"base_value": {
"type": "number"
},
"contribution_factor": {
"type": "number"
},
"effective_contribution": {
"type": "number"
}
},
"additionalProperties": false
}
},
"context_modifier_sum": {
"type": "number"
},
"population_multiplier": {
"type": "number"
},
"blast_radius_multiplier": {
"type": "number"
},
"impact_scale": {
"type": "number"
},
"confidence_factor": {
"type": "number"
},
"temporal_reduction": {
"type": "number"
},
"temporal_adjustment": {
"type": "number"
},
"calibration_status": {
"type": "string",
"enum": [
"provisional",
"sector_validated",
"custom"
]
},
"calibration_source": {
"type": [
"string",
"null"
],
"format": "uri"
},
"weight_provisional_notice": {
"type": [
"string",
"null"
]
},
"assumptions": {
"type": "array",
"items": {
"type": "string"
}
},
"precision_notes": {
"type": "string"
}
},
"additionalProperties": true
},
"harm_acute": {
"type": "boolean"
},
"harm_chronic_proxy": {
"type": "boolean"
},
"realized_harm_categories": {
"type": "array",
"items": {
"type": "string",
"enum": [
"Physical_Harm",
"Environmental_Harm",
"Security_Integrity",
"Privacy_Violation",
"Financial_Loss",
"Psychological_Harm",
"Property_Damage",
"Reputational_Harm"
]
},
"minItems": 1,
"uniqueItems": true
},
"cumulative_bias_index": {
"type": "number",
"minimum": 0.0,
"maximum": 1.0
},
"linked_vulnerability_id": {
"type": "string"
},
"exposure_duration_hours": {
"type": "number",
"minimum": 0
},
"ai_system_type": {
"type": "string",
"enum": [
"LLM",
"VLM",
"RAG_Pipeline",
"Agentic",
"Multi_Agent",
"Traditional_ML",
"Other"
]
},
"non_adversarial_failure_type": {
"type": "string"
},
"agent_escalation_chain": {
"type": "array",
"items": {
"type": "string"
}
},
"mcp_endpoint_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"oauth_pivot_chain": {
"type": "array",
"items": {
"type": "string"
}
},
"policy_enforcement_point": {
"type": "string"
},
"atlas_technique_id": {
"type": "string",
"pattern": "^AML\\.T[0-9]{4}(\\.[0-9]{3})?$"
},
"sector_code": {
"type": "string",
"enum": [
"ENERGY",
"TRANSPORT",
"BANKING",
"FINANCIAL_MARKETS",
"HEALTH",
"DRINKING_WATER",
"WASTE_WATER",
"DIGITAL_INFRA",
"ICT_SERVICES",
"PUBLIC_ADMIN",
"SPACE",
"POSTAL",
"WASTE_MGMT",
"CHEMICALS",
"FOOD",
"MANUFACTURING",
"TELECOM",
"RESEARCH",
"OTHER"
]
},
"nace_code_actual": {
"type": "string",
"pattern": "^[A-Z](\\d{2}(\\.\\d{1,2})?)?$"
},
"naics_code_actual": {
"type": "string",
"pattern": "^\\d{2,6}$"
},
"jurisdiction_country_code": {
"type": "string",
"pattern": "^[A-Z]{2}(-[A-Z0-9]{1,3})?$"
},
"regulatory_obligations": {
"type": "array",
"items": {
"type": "string",
"enum": [
"EU_AI_Act_Article_73",
"GDPR_Article_33",
"NIS2_Article_23",
"DORA_Article_19",
"Sectoral_Reporting",
"None"
]
},
"minItems": 1,
"uniqueItems": true
},
"regulatory_trigger": {
"type": "boolean"
},
"trigger_confidence": {
"type": "string",
"enum": [
"LOW",
"MEDIUM",
"HIGH"
]
},
"human_review_recommended": {
"type": "boolean"
},
"sensitive_data": {
"type": "boolean"
},
"critical_sector": {
"type": "boolean"
},
"vulnerable_population": {
"type": "boolean"
},
"x_extensions": {
"type": "object",
"additionalProperties": true
}
},
"allOf": [
{
"if": {
"properties": {
"record_type": {
"const": "Incident"
}
},
"required": [
"record_type"
]
},
"then": {
"required": [
"severity_analytical_score",
"severity_presentation_score",
"severity_level",
"severity_rationale",
"realized_harm_categories"
]
}
},
{
"if": {
"properties": {
"regulatory_trigger": {}
},
"required": [
"regulatory_trigger"
]
},
"then": {
"required": [
"trigger_confidence",
"human_review_recommended"
]
}
},
{
"if": {
"properties": {
"root_cause_specific_type": {
"const": "Adversarial_Attack"
}
},
"required": [
"root_cause_specific_type"
]
},
"then": {
"required": [
"exploit_path_description"
]
}
},
{
"if": {
"properties": {
"severity_rationale": {
"properties": {
"calibration_status": {
"const": "provisional"
}
},
"required": [
"calibration_status"
]
}
},
"required": [
"severity_rationale"
]
},
"then": {
"properties": {
"severity_rationale": {
"required": [
"weight_provisional_notice"
]
}
}
}
}
],
"unevaluatedProperties": false
}
5. Conditional Validation Rules
| Rule | Enforcement |
|---|---|
| Incident records | MUST include severity_analytical_score, severity_presentation_score, severity_level, severity_rationale, and realized_harm_categories. |
| Regulatory trigger | regulatory_trigger requires trigger_confidence and human_review_recommended. |
| Provisional calibration | severity_rationale.calibration_status = provisional requires weight_provisional_notice. |
| Adversarial attack | root_cause_specific_type = Adversarial_Attack requires exploit_path_description. |
| Custom root cause | Custom root_cause_specific_type values MUST use x_ prefix. |
| Sector taxonomy | sector_code MUST be one of the 19 normative UAIF sector codes; NAICS/NACE belong in mapping metadata fields. |
6. Severity Matrix
| Level | Score Boundary | Rule |
|---|---|---|
| 1 Info | 0.0 <= score < 2.0 | No external harm |
| 2 Low | 2.0 <= score < 4.0 | Low operational harm |
| 3 Medium | 4.0 <= score < 6.5 | Material but generally non-critical harm |
| 4 High | 6.5 <= score < 8.5 | High impact; potential Article 73 routing proxy where applicable |
| 5 Critical | 8.5 <= score <= 10.0 | Critical/systemic impact; Article 73 review required where applicable |
7. Reference Severity Calculator
The reference implementation below mirrors TCR-STD-002 Section 4. It does not use collapsed single-score fields or stakeholder multipliers.
from decimal import Decimal, ROUND_HALF_UP
HARM_WEIGHTS = {
"Physical_Harm": 4.0,
"Environmental_Harm": 3.5,
"Security_Integrity": 3.5,
"Privacy_Violation": 3.0,
"Financial_Loss": 2.5,
"Psychological_Harm": 2.0,
"Property_Damage": 2.0,
"Reputational_Harm": 1.5,
}
CONTEXT_MODIFIERS = {
"Model_Poisoning": 2.0,
"RAG_leakage": 1.5,
"Prompt_Injection": 1.5,
"Agent_Hijack": 1.5,
"Agentic": 1.0,
"Adversarial": 0.5,
}
DEFAULT_REGULATED_ZONES = {
"AT","BE","BG","HR","CY","CZ","DK","EE","FI","FR","DE","GR","HU","IE",
"IT","LV","LT","LU","MT","NL","PL","PT","RO","SK","SI","ES","SE","NO","IS","LI"
}
def _round_decimal(value, places=1):
quantum = Decimal("1." + ("0" * places)) if places else Decimal("1")
return float(Decimal(str(value)).quantize(quantum, rounding=ROUND_HALF_UP))
def _calculate_context_contribution(context_list):
valid = sorted([(c, CONTEXT_MODIFIERS[c]) for c in context_list if c in CONTEXT_MODIFIERS], key=lambda x: x[1], reverse=True)
total, factor, applied = 0.0, 1.0, []
for ctx, base in valid:
capped = min(1.5, base)
contribution = capped * factor
total += contribution
applied.append({"context": ctx, "base_value": base, "contribution_factor": factor, "effective_contribution": _round_decimal(contribution, 2)})
if total >= 3.0:
break
factor *= 0.5
return min(3.0, total), applied
def score_to_level(score):
if score < 2.0: return 1
if score < 4.0: return 2
if score < 6.5: return 3
if score < 8.5: return 4
return 5
def calculate_uaif_severity(harms, contexts, population_multiplier, blast_radius_multiplier, attribution_conf, investigation_status, evidence_quality):
valid_harms = [(h, HARM_WEIGHTS[h]) for h in harms if h in HARM_WEIGHTS]
if not valid_harms:
return {"severity_analytical_score": 0.0, "severity_presentation_score": 0.0, "severity_level": 1}
dominant_harm, dominant_weight = max(valid_harms, key=lambda x: x[1])
others_sum = sum(w for h, w in valid_harms if h != dominant_harm)
adjusted_base = _round_decimal(dominant_weight + min(2.0, 0.5 * others_sum), 1)
context_add, context_audit = _calculate_context_contribution(contexts)
context_add = _round_decimal(context_add, 2)
base_score = _round_decimal(min(10.0, adjusted_base + context_add), 1)
impact_scale = _round_decimal(min(1.8, max(population_multiplier, blast_radius_multiplier)), 2)
confidence_factor = _round_decimal((attribution_conf + investigation_status + evidence_quality) / 3.0, 2)
temporal_reduction = _round_decimal((1.0 - confidence_factor) * 0.5, 2)
temporal_adjustment = _round_decimal(base_score * (1.0 - temporal_reduction), 1)
presentation_score = _round_decimal(max(0.0, min(10.0, temporal_adjustment * impact_scale)), 1)
return {
"severity_analytical_score": base_score,
"severity_presentation_score": presentation_score,
"severity_level": score_to_level(presentation_score),
"severity_rationale": {
"dominant_harm": dominant_harm,
"dominant_weight": dominant_weight,
"context_modifiers_applied": context_audit,
"context_modifier_sum": context_add,
"population_multiplier": population_multiplier,
"blast_radius_multiplier": blast_radius_multiplier,
"impact_scale": impact_scale,
"confidence_factor": confidence_factor,
"temporal_reduction": temporal_reduction,
"temporal_adjustment": temporal_adjustment,
}
}
def calculate_regulatory_trigger_confidence(severity_presentation_score, calibration_status, jurisdiction_country_code, sensitive_data=False, critical_sector=False, vulnerable_population=False, regulated_zones=None, threshold_score=6.5):
country_base = jurisdiction_country_code.split("-")[0].upper()
zones = set(regulated_zones) if regulated_zones else DEFAULT_REGULATED_ZONES
base_trigger = (severity_presentation_score >= threshold_score) and (country_base in zones)
distance = abs(severity_presentation_score - threshold_score)
if calibration_status == "sector_validated":
confidence = "HIGH" if distance >= 0.3 else "MEDIUM"
elif calibration_status == "custom":
confidence = "MEDIUM"
else:
confidence = "MEDIUM" if distance >= 0.5 else "LOW"
enrichment_active = sensitive_data or critical_sector or vulnerable_population
trigger = base_trigger and ((confidence == "HIGH") or (confidence == "MEDIUM" and enrichment_active))
return {"regulatory_trigger": trigger, "trigger_confidence": confidence, "human_review_recommended": confidence == "LOW", "distance_from_threshold": round(distance, 2), "legal_notice": "UAIF regulatory trigger is technical routing assistance only; legal counsel determines EU AI Act Article 73 obligations."}
8. Sample Valid Incident Payload
{
"incident_uuid": "123e4567-e89b-12d3-a456-426614174000",
"incident_title": "RAG tenant isolation failure disclosed financial records",
"incident_summary": "A retrieval-augmented generation system returned records from another tenant after a missing tenant-scoped filter in the vector database query path.",
"reporting_timestamp": "2026-06-24T12:00:00Z",
"reporter_confidence_level": 4,
"deduplication_hash": "9b71d224bd62f3785d96d46ad3ea3d73319d6224bd62f3785d96d46ad3ea3d73",
"remediation_status": "Investigating",
"record_type": "Incident",
"root_cause_primary_domain": "System",
"root_cause_specific_type": "RAG_Leakage",
"root_cause_confidence": "HIGH",
"severity_analytical_score": 6.8,
"severity_presentation_score": 7.8,
"severity_level": 4,
"severity_justification": "RAG leakage exposed sensitive financial records to an unauthorised tenant and required regulatory review.",
"severity_rationale": {
"dominant_harm": "Privacy_Violation",
"dominant_weight": 3.0,
"secondary_harms": [
"Financial_Loss",
"Reputational_Harm"
],
"secondary_contribution": 2.0,
"context_modifiers_applied": [
{
"context": "RAG_leakage",
"base_value": 1.5,
"contribution_factor": 1.0,
"effective_contribution": 1.5
}
],
"context_modifier_sum": 1.5,
"population_multiplier": 1.2,
"blast_radius_multiplier": 1.0,
"impact_scale": 1.2,
"confidence_factor": 0.8,
"temporal_reduction": 0.1,
"temporal_adjustment": 6.1,
"calibration_status": "provisional",
"calibration_source": null,
"weight_provisional_notice": "Default harm weights are provisional pending empirical validation.",
"assumptions": [
"Tenant isolation failure confirmed from logs."
],
"precision_notes": "Rounded per UAIF v1.0 ROUND_HALF_UP rules."
},
"realized_harm_categories": [
"Privacy_Violation",
"Financial_Loss",
"Reputational_Harm"
],
"ai_system_type": "RAG_Pipeline",
"sector_code": "BANKING",
"nace_code_actual": "K64.2",
"naics_code_actual": "522110",
"jurisdiction_country_code": "DE",
"regulatory_obligations": [
"EU_AI_Act_Article_73",
"GDPR_Article_33"
],
"regulatory_trigger": true,
"trigger_confidence": "MEDIUM",
"human_review_recommended": false,
"sensitive_data": true,
"critical_sector": true,
"vulnerable_population": false
}
9. Invalid Legacy Payload Patterns
| Legacy Pattern | Reason Rejected |
|---|---|
| Legacy single-score field | Use severity_analytical_score and severity_presentation_score. |
| Legacy stakeholder multiplier | Not part of UAIF v1.0 normative calculation. |
| Non-normative financial/property harm labels | Use Financial_Loss / Property_Damage. |
| sector_code = NAICS:522110 | Use sector_code = BANKING and place raw code in naics_code_actual. |
| Obsolete EU AI Act incident-reporting proxy references | Use Article 73 technical routing notice. |
| Legacy expanded-layer architecture | UAIF v1.0 schema uses seven layers; control-plane fields are L5. |
10. Regulatory Translation Boundary
The schema does not produce direct regulatory filing packages. Translators MAY generate advisory mappings for EU AI Act Article 73, GDPR Article 33, NIS2 Article 23, DORA Article 19, or sector-specific obligations, but legal counsel SHALL determine final reporting status, addressees, and deadlines. EU AI Act Article 73 timelines SHALL NOT be replaced with GDPR or NIS2 timing logic.
Web edition notice
This HTML edition is provided for discovery, accessibility and search. Preserve the document identifier, version, publication status, limitations and GEL terms when citing or reusing it. The downloadable source remains available for recordkeeping.