canon:
  id: itcc
  name: Information Technology Capability Canon
  short_name: ITCC
  version: '0.1'
  status: draft
  purpose: Implementation-independent canonical vocabulary for common information-technology capabilities.
resources:
- id: C
  name: Compute
  description: Generic execution capacity.
- id: S
  name: Storage
  description: Persistence capacity.
- id: N
  name: Networking
  description: Information movement.
- id: I
  name: Intelligence
  description: Metered or purchased cognitive or semantic processing capability.
- id: P
  name: Platform
  description: Enabling operational overhead that makes other resources usable.
maturity_model:
- id: D0
  name: Absent
  description: Capability is not provided.
- id: D1
  name: Experimental
  description: Proof of concept or exploratory implementation.
- id: D2
  name: Available
  description: A provider exists and can be consumed.
- id: D3
  name: Usable
  description: Documented and practically consumable.
- id: D4
  name: Production
  description: Approved for production dependency.
- id: D5
  name: Reliable
  description: Reliability is measured and actively controlled.
- id: D6
  name: Scalable
  description: Capacity and operational scaling are demonstrated.
- id: D7
  name: Strategic
  description: Governed, reusable, and deliberately evolved as a platform capability.
relationship_types:
- id: depends_on
  description: Capability normally requires another capability to operate.
- id: may_use
  description: Capability may use another capability without conceptual dependency.
- id: composes
  description: A higher-level capability or pattern is composed from lower-level capabilities.
- id: requires
  description: A landscape entity requires a capability.
- id: provides
  description: A provider supplies a capability.
- id: implements
  description: A technology or implementation realizes a provider or capability provision.
- id: consumes
  description: A provider or implementation consumes economic resources.
domains:
- id: identity
  name: Identity & Access
  capabilities:
  - id: identity.lifecycle
    name: Identity Lifecycle
    purpose: Create, maintain, suspend, recover, and remove identities over time.
    profiles:
    - human
    - machine
    - external
    - privileged
    qualities:
    - provisioning_latency
    - deprovisioning_latency
    - recovery
    - ownership
    evidence:
    - successful_provisioning
    - successful_deprovisioning
    - ownership_record
  - id: identity.authentication
    name: Authentication
    purpose: Establish that an actor controls or legitimately represents an identity.
    profiles:
    - human
    - machine
    - password
    - passkey
    - mfa
    - passwordless
    - high-assurance
    qualities:
    - assurance
    - availability
    - latency
    - factor_support
    evidence:
    - successful_authentication
    - failure_metrics
    - availability_metrics
  - id: identity.authorization
    name: Authorization
    purpose: Determine whether an actor may perform an action on a resource.
    profiles:
    - rbac
    - abac
    - relationship-based
    - policy-based
    qualities:
    - decision_latency
    - policy_coverage
    - explainability
    evidence:
    - policy_tests
    - authorization_decisions
    - denial_evidence
  - id: identity.federation
    name: Identity Federation
    purpose: Establish and use trust relationships between identity domains.
    profiles:
    - workforce
    - customer
    - partner
    - machine
    qualities:
    - trust_scope
    - protocol_support
    - availability
    evidence:
    - federation_configuration
    - successful_federated_login
  - id: identity.organization
    name: Organization & Tenancy
    purpose: Associate identities, resources, policies, and operations with organizational or tenant boundaries.
    profiles:
    - organization
    - team
    - tenant
    - hierarchy
    - delegation
    qualities:
    - isolation
    - delegation
    - hierarchy_depth
    evidence:
    - tenant_isolation_tests
    - membership_records
- id: data
  name: Data & State
  capabilities:
  - id: data.transactional
    name: Transactional Persistence
    purpose: Persist structured mutable state with defined consistency and transaction semantics.
    profiles:
    - relational
    - document
    - key-value
    qualities:
    - consistency
    - durability
    - availability
    - latency
    - throughput
    evidence:
    - durability_tests
    - availability_metrics
  - id: data.object
    name: Object Persistence
    purpose: Persist opaque objects, files, blobs, documents, or similar binary or semi-structured objects.
    profiles:
    - blob
    - document
    - artifact
    qualities:
    - durability
    - availability
    - retention
    - size_limits
    evidence:
    - object_integrity_tests
    - availability_metrics
  - id: data.cache
    name: Caching
    purpose: Maintain temporary or derived state for accelerated access.
    profiles:
    - local
    - distributed
    - content
    qualities:
    - hit_rate
    - latency
    - eviction_policy
    - freshness
    evidence:
    - cache_metrics
    - latency_metrics
  - id: data.backup
    name: Backup & Restore
    purpose: Create recoverable copies or recovery points and restore previously valid persisted state after loss,
      corruption, or erroneous modification.
    profiles:
    - database
    - object
    - volume
    qualities:
    - rpo
    - rto
    - retention
    - isolation
    - geographical_separation
    - restore_validation
    depends_on:
    - data.object
    may_use:
    - runtime.scheduling
    - operations.observability
    evidence:
    - successful_backup
    - successful_restore_test
    - measured_rpo
    - measured_rto
  - id: data.archive
    name: Archive & Retention
    purpose: Preserve information for long-term retention under defined lifecycle, integrity, and retrieval rules.
    profiles:
    - regulatory
    - operational
    - cold
    qualities:
    - retention
    - immutability
    - retrievability
    - integrity
    evidence:
    - retention_policy
    - integrity_verification
    - retrieval_test
  - id: data.search
    name: Search & Retrieval
    purpose: Locate persisted information based on indexed or queryable characteristics.
    profiles:
    - lexical
    - structured
    - faceted
    - semantic
    - hybrid
    qualities:
    - latency
    - recall
    - precision
    - freshness
    evidence:
    - search_tests
    - latency_metrics
- id: integration
  name: Integration & Communication
  capabilities:
  - id: integration.api
    name: API Exposure
    purpose: Expose machine-consumable interfaces through which systems can invoke or retrieve functionality.
    profiles:
    - request-response
    - streaming
    - public
    - internal
    qualities:
    - availability
    - latency
    - compatibility
    - rate_limits
    evidence:
    - contract_tests
    - availability_metrics
  - id: integration.messaging
    name: Messaging & Eventing
    purpose: Exchange asynchronous messages or events between producers and consumers.
    profiles:
    - queue
    - pub-sub
    - event-stream
    - event-bus
    qualities:
    - delivery_semantics
    - ordering
    - durability
    - latency
    - throughput
    evidence:
    - delivery_tests
    - lag_metrics
  - id: integration.exchange
    name: Data Exchange
    purpose: Move datasets, files, or structured information between systems.
    profiles:
    - batch
    - file
    - stream
    - managed-transfer
    qualities:
    - integrity
    - latency
    - throughput
    - retries
    evidence:
    - transfer_tests
    - integrity_checks
  - id: integration.notification
    name: Notification
    purpose: Deliver information to human users or external endpoints.
    profiles:
    - email
    - sms
    - push
    - chat
    - webhook
    - physical-mail
    qualities:
    - delivery_rate
    - latency
    - channel_support
    - tracking
    evidence:
    - delivery_receipts
    - failure_metrics
  - id: integration.traffic
    name: Traffic Management
    purpose: Route, balance, control, filter, or shape communication between endpoints.
    profiles:
    - load-balancing
    - ingress
    - service-routing
    - rate-limiting
    - api-gateway
    qualities:
    - availability
    - latency
    - routing_correctness
    - capacity
    evidence:
    - routing_tests
    - availability_metrics
- id: runtime
  name: Runtime & Automation
  capabilities:
  - id: runtime.execution
    name: Workload Execution
    purpose: Execute software workloads with defined runtime resources and isolation.
    profiles:
    - process
    - container
    - virtual-machine
    - function
    - batch
    qualities:
    - availability
    - isolation
    - startup_time
    - capacity
    evidence:
    - execution_tests
    - capacity_metrics
  - id: runtime.configuration
    name: Configuration
    purpose: Supply controlled runtime configuration to software and services.
    profiles:
    - static
    - dynamic
    - environment
    - feature
    qualities:
    - versioning
    - propagation_latency
    - consistency
    - auditability
    evidence:
    - configuration_history
    - propagation_tests
  - id: runtime.scheduling
    name: Scheduling
    purpose: Initiate activities according to time, delay, calendar, or recurrence.
    profiles:
    - cron
    - calendar
    - delay
    - recurring
    qualities:
    - timing_accuracy
    - delivery_guarantee
    - timezone_support
    evidence:
    - schedule_execution_records
  - id: runtime.workflow
    name: Workflow Orchestration
    purpose: Coordinate multi-step activities, state transitions, dependencies, retries, and completion.
    profiles:
    - durable
    - human-in-the-loop
    - saga
    - agentic
    qualities:
    - durability
    - retry_semantics
    - visibility
    - recovery
    may_use:
    - integration.messaging
    - runtime.scheduling
    - integration.notification
    evidence:
    - workflow_completion_records
    - recovery_tests
  - id: runtime.deployment
    name: Deployment & Release
    purpose: Bring defined software versions and configurations into operational environments in a controlled manner.
    profiles:
    - rolling
    - blue-green
    - canary
    - immutable
    qualities:
    - rollback
    - lead_time
    - failure_rate
    - traceability
    evidence:
    - deployment_records
    - rollback_test
- id: operations
  name: Operations & Assurance
  capabilities:
  - id: operations.observability
    name: Observability
    purpose: Establish operational state and behavior from telemetry such as logs, metrics, traces, events, and
      derived signals.
    profiles:
    - logs
    - metrics
    - traces
    - events
    - profiles
    qualities:
    - coverage
    - freshness
    - retention
    - queryability
    evidence:
    - telemetry_coverage
    - dashboard_or_query_evidence
  - id: operations.alerting
    name: Alerting
    purpose: Detect relevant conditions and surface them to humans or automation.
    profiles:
    - threshold
    - anomaly
    - event
    - slo
    qualities:
    - detection_latency
    - precision
    - delivery
    - escalation
    may_use:
    - operations.observability
    - integration.notification
    evidence:
    - alert_tests
    - incident_linkage
  - id: operations.audit
    name: Audit
    purpose: Produce attributable historical evidence about relevant actions, changes, and decisions.
    profiles:
    - security
    - administrative
    - business
    - decision
    qualities:
    - integrity
    - attribution
    - retention
    - queryability
    evidence:
    - audit_records
    - integrity_verification
  - id: operations.recovery
    name: Service Recovery
    purpose: Restore an operational service after failure or degradation.
    profiles:
    - restart
    - failover
    - rebuild
    - disaster-recovery
    qualities:
    - rto
    - recovery_success_rate
    - automation
    may_use:
    - data.backup
    - operations.observability
    evidence:
    - recovery_tests
    - incident_recovery_records
  - id: operations.continuity
    name: Continuity
    purpose: Maintain acceptable service operation despite disruption.
    profiles:
    - high-availability
    - multi-zone
    - multi-region
    - degraded-mode
    qualities:
    - availability
    - fault_tolerance
    - capacity_reserve
    evidence:
    - continuity_tests
    - availability_metrics
- id: security
  name: Security & Governance
  capabilities:
  - id: security.secrets
    name: Secret Management
    purpose: Protect, distribute, rotate, and revoke confidential credentials and secrets.
    profiles:
    - static
    - dynamic
    - application
    - human
    qualities:
    - rotation
    - access_control
    - auditability
    - availability
    evidence:
    - rotation_records
    - access_audit
  - id: security.keys
    name: Key & Certificate Management
    purpose: Create, protect, distribute, rotate, validate, and revoke cryptographic keys and certificates.
    profiles:
    - tls
    - signing
    - encryption
    - pki
    qualities:
    - rotation
    - revocation
    - expiry_control
    - key_protection
    evidence:
    - certificate_inventory
    - rotation_records
  - id: security.policy
    name: Policy Management & Enforcement
    purpose: Define, distribute, evaluate, and enforce machine-interpretable policies.
    profiles:
    - access
    - configuration
    - admission
    - compliance
    qualities:
    - coverage
    - decision_latency
    - versioning
    - explainability
    evidence:
    - policy_tests
    - decision_records
  - id: security.vulnerability
    name: Vulnerability Management
    purpose: Identify, assess, prioritize, remediate, mitigate, and track exploitable weaknesses.
    profiles:
    - source
    - dependency
    - image
    - runtime
    - infrastructure
    qualities:
    - coverage
    - time_to_detect
    - time_to_remediate
    - risk_acceptance
    evidence:
    - scan_results
    - remediation_records
  - id: governance.evidence
    name: Compliance Evidence
    purpose: Produce and maintain evidence supporting governance, assurance, certification, or compliance assertions.
    profiles:
    - technical
    - organizational
    - regulatory
    qualities:
    - completeness
    - traceability
    - freshness
    - integrity
    evidence:
    - evidence_records
    - assessment_links
  - id: governance.lifecycle
    name: Information Lifecycle Governance
    purpose: Apply rules governing information retention, handling, deletion, preservation, and lifecycle transitions.
    profiles:
    - retention
    - deletion
    - legal-hold
    - classification
    qualities:
    - coverage
    - enforcement
    - traceability
    evidence:
    - lifecycle_policy
    - deletion_records
    - retention_evidence
- id: commerce
  name: Commerce
  capabilities:
  - id: commerce.metering
    name: Metering
    purpose: Measure usage or activity that is commercially or contractually relevant.
    profiles:
    - usage
    - event
    - capacity
    - time
    qualities:
    - accuracy
    - completeness
    - latency
    - auditability
    evidence:
    - meter_records
    - reconciliation
  - id: commerce.billing
    name: Billing
    purpose: Calculate amounts owed based on contracts, pricing rules, entitlements, metering, or events.
    profiles:
    - subscription
    - usage-based
    - one-time
    - hybrid
    qualities:
    - accuracy
    - explainability
    - reconciliation
    - currency_support
    may_use:
    - commerce.metering
    - commerce.entitlement
    evidence:
    - invoice_tests
    - billing_reconciliation
  - id: commerce.payment
    name: Payment
    purpose: Transfer monetary value between parties.
    profiles:
    - card
    - sepa
    - bank-transfer
    - wallet
    - payout
    - recurring
    qualities:
    - success_rate
    - settlement_time
    - currency_support
    - refund_support
    may_use:
    - identity.authentication
    - operations.audit
    - integration.api
    evidence:
    - payment_records
    - settlement_reconciliation
  - id: commerce.entitlement
    name: Entitlement
    purpose: Determine which products, features, capacities, or service levels a customer or actor is contractually
      allowed to use.
    profiles:
    - feature
    - capacity
    - plan
    - time-bound
    qualities:
    - decision_latency
    - consistency
    - auditability
    may_use:
    - identity.authorization
    evidence:
    - entitlement_tests
    - decision_records
- id: intelligence
  name: Intelligence
  capabilities:
  - id: intelligence.generation
    name: Generation
    purpose: Produce novel information representations from context or instructions.
    profiles:
    - text
    - image
    - audio
    - video
    - code
    - structured-data
    qualities:
    - quality
    - latency
    - cost
    - safety
    evidence:
    - evaluation_results
    - latency_metrics
  - id: intelligence.extraction
    name: Extraction & Classification
    purpose: Derive structured information, labels, attributes, or classifications from input.
    profiles:
    - ocr
    - document-extraction
    - entity-extraction
    - classification
    - speech-recognition
    qualities:
    - accuracy
    - recall
    - precision
    - latency
    evidence:
    - evaluation_results
    - golden_set_tests
  - id: intelligence.embedding
    name: Semantic Representation
    purpose: Produce machine-usable semantic representations of information.
    profiles:
    - text
    - image
    - multimodal
    qualities:
    - dimensionality
    - semantic_quality
    - latency
    - cost
    evidence:
    - retrieval_benchmarks
    - latency_metrics
  - id: intelligence.retrieval
    name: Semantic Retrieval & Ranking
    purpose: Select or rank information according to semantic relevance.
    profiles:
    - vector
    - reranking
    - hybrid
    - multimodal
    qualities:
    - recall
    - precision
    - ranking_quality
    - latency
    may_use:
    - intelligence.embedding
    - data.search
    evidence:
    - retrieval_benchmarks
  - id: intelligence.reasoning
    name: Reasoning & Decision
    purpose: Derive judgments, plans, decisions, hypotheses, or action proposals from context and constraints.
    profiles:
    - analysis
    - planning
    - decision
    - agentic
    qualities:
    - task_success
    - reliability
    - latency
    - cost
    - explainability
    may_use:
    - intelligence.retrieval
    evidence:
    - task_evaluations
    - decision_records