Ontology at the Ledger

Frank Coyle has been teaching computer science for more than thirty years, and in a conference talk I watched this week he stood in front of a room he estimated at five thousand people and argued that the oldest formal tradition in the field belongs inside the newest thing in it. Agents are probabilistic. Ontologies are formal. Wire the second around the first, he proposed, and you get guardrails: a system where the model imagines and something rigid checks. He compressed the whole architecture into one slogan, and it is a good one. Pydantic at the door, ontology at the ledger.

I knew the word before it belonged to AI. One summer in the big data years I did research on ontologies, back when their job description was integration: entities and relationships assembled into a graph so that one messy dataset could speak to another. When the summer ended, the word went quiet, and for a decade I mostly heard it from philosophers.

The pitch that brought it back is trust. Large language models are probabilistic by construction. The machinery that lets them imagine is the same machinery that lets them make things up, and no amount of prompting removes a property that is the point of the design. Correctness has to come from somewhere outside the model. Coyle’s proposal makes the outside formal: Pydantic, the Python validation library, checking types on the way into every tool call; an ontology validating what comes back; side effects held until both agree.

I liked the slogan immediately. It has the shape of good engineering, checks stationed where the risk lives.

Then I sat down to picture the actual wiring, and the word came apart in my hands.

The loop has three places to check

Mechanically, an agent is a loop. You hand a model a goal and some context. The model proposes an action, usually a tool call: a function name and a blob of arguments. Your harness executes the call, appends the result, and the loop continues until the work is done or something stops it. Everything the model does arrives as a proposal; the harness decides what touches the world. Every consequence an agent has passes through that narrow step, which is what makes the loop such a natural place to stand guard.

Try to attach an ontology to the loop, though, and you find three different jobs hiding under the one word. The first is the map, the domain vocabulary and structure the model reads before it proposes. The second is Coyle’s door: the shape check on a proposed call before anything runs, the types and required fields and enumerations. The third is his ledger, the check that runs after the shape passes and before the side effect commits, the one that has to consult the world. A second refund for the same order clears Coyle’s door untouched, because the call is perfectly well formed. Only a check that can look up the first refund can refuse the second.

The three jobs share a name and almost nothing else. The map advises. The door inspects the proposal alone, no history required. The ledger interrogates the proposal against the current state of the world, and the guardrail promise lives almost entirely there. If an ontology is going to keep an agent honest anywhere, it is at the ledger.

The map is winning under other names

Start with the map, because the map is the half of the pitch that is already succeeding, and the half my summer research would recognize. The definition the field has carried since the nineties calls an ontology a formal specification of a shared conceptualization. Strip the ceremony off that phrase and it gives an instruction: write down what your domain means, in a form a machine can read. Agents reward the discipline measurably. Ask a model questions in English against raw database tables and, in dbt’s own benchmark, it answers correctly about a quarter of the time; put a semantic layer between them, one that defines what revenue and an active customer actually mean, and accuracy climbs to 83 percent on the questions the layer can address. Palantir sells the same move under the literal name Ontology: typed business objects, typed actions, agents that see a company through the company’s own categories. Tool descriptions do the job at a smaller scale. A paragraph in the context window about what a refund is changes what the model proposes.

Notice what every version of the map has in common. It raises the odds that the model proposes something sensible, and raising the odds is all it does. The model remains free to ignore every word of it. Whatever fraction of the guardrail promise the map delivers, it delivers by persuasion.

The tool named for the ledger cannot hold it

So enforcement falls to the ledger, and the talk is specific about the technology that should hold it: OWL, the semantic web’s axiom language, formal properties sitting beside the graph. The flagship example is the double refund. Declare the refund relation a functional property, one value at most, and when an agent books a second refund against a paid order, the reasoner catches the violation. Coyle gave a second example almost in passing. If the data says Bob is Jim’s father and BB is Jim’s father, the reasoner concludes that Bob and BB must be two names for the same individual.

The second example is the first one, run honestly.

OWL was designed for the open web, and two assumptions sit at its core. The world is open, so a fact missing from the graph is merely a fact nobody has stated yet; the graph reads absence as silence rather than denial. And names are plural: two identifiers routinely point at one thing, so nothing guarantees that two refund records describe two refunds. Under those assumptions, a functional property with two values is an opportunity for inference rather than a violation. Ask an OWL reasoner to guard the refund ledger and it does exactly what its own primer says it should do with Bob and BB: it concludes the two refunds are the same refund, merges them, and reports a consistent graph. The duplicate payout is laundered into correctness.

The reasoner is doing its job. On a web where anyone can say anything about anything, identification is the intelligent response to a collision. Refusal calls for the opposite assumptions: this database is complete, these identifiers are distinct, absence means no. The semantic web community litigated the mismatch for a decade and published its verdict as a standard called SHACL, a constraint language created in 2017 because practitioners kept hiring OWL to validate data and kept discovering that it would only infer. The community that built the reasoner had to build a second tool to do the job the first one keeps being offered on conference stages.

Formal knowledge scales by giving up inference

It would be comfortable to dismiss all this as one professor’s slides. The record says the pattern is the signature move of the entire tradition.

Doug Lenat spent forty years and two thousand person-years of team effort building Cyc, the largest attempt in history to formalize knowledge by hand. In his final paper, written with Gary Marcus in 2023, there is a footnote that deserves to be famous. Cyc’s general theorem prover, the engine that could in principle validate anything against everything, had been switched off roughly a decade earlier, after the team noticed that a million consecutive queries reaching it had timed out. What actually ran was more than a thousand hand-written, special-purpose reasoners. The largest formal knowledge project ever built abandoned general inference, and the effect the team reported was that the system got faster.

The expert systems of the 1980s hit the same wall from the other side. XCON, the configurator that justified a decade of symbolic AI investment, grew from 700 rules to 6,200 in seven years, with half the rule base changing every year, and the paper documenting it records engineers who had grown afraid to modify rules they could no longer trace. Digital’s fix was a constrained authoring language with enforced conventions and tooling, which a modern reader would recognize as a linter. Meanwhile the piece of the semantic web that actually conquered the public web, schema.org, is the piece that gave up the most: a mostly flat vocabulary of some eight hundred types, no reasoning anywhere, enforced by search engines stripping rich results from pages that lie.

Even the newest entrant keeps the pattern. The first formally verified guardrail to ship in production, Amazon’s automated reasoning checks, compiles policy documents into logic and runs a solver over agent outputs, and the translation from the model’s free text into that logic is performed by other language models. Amazon’s own documentation concedes the translation may contain errors. The deterministic core is real, and the road into it is probabilistic at both ends.

Across the tradition’s whole history the pattern holds: formal knowledge scales by giving up inference. The reasoner is the recurring dream. The schema is the recurring survivor.

Which settles the question of what actually holds a ledger, because software has known for decades. A UNIQUE constraint on a refunds table is a functional property that has run in production since the nineties, enforced in microseconds, with an error message an agent can read and retry against. An enumeration in a tool schema is the status axiom from Coyle’s slides, enforced so early that the model cannot even emit an illegal value. A precondition in harness code, four lines that fetch the order and compare the payee, is the disjointness check, the one that refuses to let two records collapse into one. The axioms from the talk all survive the translation, and the knowledge inside them is ontological in every sense the definition requires; what gets left behind is the reading that turned violations into inferences. The enforcement has lived in ordinary code all along.

A guard that cannot be persuaded

The fair objection arrives on schedule: models keep improving, so why maintain brittle rules at all? Ask the model to check itself, or station a second model as a judge, and cover everything a rule cannot express. Earlier this month, in Two Green Checks, One Opinion, I argued that two frontier models reviewing each other are two averages of the same web, and that their unanimous approval counts as one opinion. The measurements keep landing on that side. One study this year found that model judges’ scores converge with the judged model’s assessment of itself, in a way human raters’ scores did not.

A judge that thinks like the defendant fails like the defendant.

The word rule needs one qualification, because agents now ship with rules written in English, files of instructions the model reads and mostly honors. Those live at the map, and they bind the way the map binds: by persuasion. A sentence becomes a ledger rule only when it runs as code outside the model, where following it stops being the model’s choice.

A rule of that kind holds a position no model can occupy: it fails independently, because it cannot think at all. It cannot be persuaded, cannot be prompt-injected, cannot drift toward the failure modes of the thing it checks. The price is scope: a rule catches exactly the violations someone anticipated and wrote down, and its approval certifies nothing beyond its own text. What it does certify, nothing else in the loop can: this specific thing did not happen, with certainty, on every iteration, for free.

Three moves, and my own ledger is bare

So integrating an ontology into an agent loop turns out to mean three modest moves rather than one grand one. Write the domain into the context, where it persuades. Write the shapes into the schemas, where the model cannot emit a malformed call. Write the few invariants whose violation costs real money into plain code at the ledger, where they refuse, and let the reasoner go.

My own agent team runs mostly on the persuasion layers today. The specs are careful, the review is cross-vendor, and both of those live on the advice side of the line; the build gates catch what a build can catch. Nothing underneath the team refuses a specific action: no invariant says what a release may never do, what the loop may never spend. The tempting ending is a promise to write that invariant, and a promise is one more rule in English; I have just spent an essay on how far those bind. The correction I can make right now is to Coyle’s slogan, and it costs one word. Pydantic at the door, rules at the ledger.