Question-led guide · diagnostic
How can an ontology support RCA without claiming causality?
An RCA evidence graph that uses semantic relationships to generate and test candidates while keeping dependency, sequence, correlation, mechanism, and cause distinct.
Direct answer
An ontology supports RCA by giving the investigator typed entities, identities, dependencies, changes, observations, time, ownership, and provenance for candidate generation and evidence joins. Keep graph relations semantically honest: `depends_on`, `deployed_as`, `observed_on`, and `preceded` are not `caused`. Promote a causal claim only through a stated mechanism, discriminating evidence, alternatives, counterevidence, and observation limits.
Scope
Use this method when an AI or human investigator queries a semantic model of services, resources, deployments, changes, telemetry, and incidents. The ontology narrows search and organizes evidence. It does not replace statistical, experimental, or mechanistic causal analysis.
Why it happens
Graphs visually imply causality. A path from deployment to service to database to alert looks like an explanation, especially when the deployment occurred shortly before impact. Most edges encode dependency, containment, sequence, ownership, or observation—not counterfactual cause.
The ontology can also amplify stale data. A declared dependency may no longer carry traffic, while a dynamic dependency may be missing. An agent traversing the graph confidently inherits those modeling errors.
Diagnosis
Audit the relation vocabulary. For each edge used by RCA, write its subject, object, direction, creation source, valid time, confidence/status, and allowed inference. Look for ambiguous relations such as related_to, impacts, or root_cause_of with no evidence contract.
Take a past incident and compare the graph available during the event with the postmortem graph. Mark which edges were observed then, added later, inferred, or corrected. If future knowledge leaks into evaluation, the ontology appears more diagnostic than it was.
Solution
Use the ontology to generate candidates: upstream/downstream dependencies, shared resources, recent changes, common owners, and affected cohorts. Attach telemetry and change observations through stable identity and time windows. Each candidate becomes a hypothesis entity, not a causal edge.
Record a mechanism: how could this condition produce the observed impact? Define predicted differences between affected and control populations, run a safe query or experiment, and collect counterevidence. Promote the claim status from candidate to supported mechanism only under explicit policy. Preserve unknown when alternatives remain.
Represent causal assertions as governed records with author, evidence, limitations, review, and validity. This makes later correction possible.
Artifact
An RCA evidence graph uses these typed records:
| Record/relation | Meaning |
|---|---|
| Entity identity | Service, deployment, instance, change, incident, user outcome |
| Structural relation | Depends on, contains, routes to, deploys, owns—noncausal by default |
| Observation | Signal, source, query, value/class, valid time, completeness |
| Change | Proposal, target/version, actor, commit, rollout, and rollback |
| Hypothesis | Candidate mechanism, affected population, and alternatives |
| Test | Predicted difference, query/experiment, result, and safety boundary |
| Evidence edge | Supports, weakens, conflicts, or is irrelevant—with provenance |
| Claim | Level, mechanism, counterevidence, observation gaps, reviewer, and status |
Common mistakes
- Labeling every dependency path as an impact or causal path.
- Using current topology to evaluate a historical investigation.
- Converting temporal order into a causal assertion.
- Storing
root_cause_ofwithout mechanism, evidence, and review state. - Letting the graph choose a remediation without separate authority and safety controls.
Evidence
PROV-O represents provenance among entities, activities, and agents without making every derivation or association a causal claim.
The W3C Recommendation defines provenance classes and relations such as generation, use, derivation, attribution, and association.
Primary source · standard · checked Aug 26, 2026
Limit: PROV-O is a provenance vocabulary, not a causal-inference framework or root-cause algorithm.
OpenTelemetry traces, metrics, logs, resources, and context provide operational observations and correlations with defined semantics.
The OpenTelemetry overview defines the major telemetry concepts and their relationships.
Primary source · standard · checked Aug 26, 2026
Limit: Recorded telemetry can be incomplete and does not by itself prove why an incident occurred.
An RCA graph should label relation semantics and evidence status so candidate paths are not presented as proven causal paths.
The evidence-graph schema below separates topology, time, observation, hypothesis, test, mechanism, and claim status.
Signal Studio author framework · reviewed Aug 26, 2026
Limit: The framework does not perform causal identification and must be paired with domain knowledge and suitable experiments or comparisons.
Limitations
Even a carefully modeled graph can encode stale topology, biased observations, missing confounders, and incorrect domain assumptions. Production experiments may be unsafe or impossible. Keep unresolved hypotheses and human review for consequential causal claims.
FAQ
- Does a dependency edge make the upstream service a cause?
- No. It identifies a possible path for influence or failure propagation. The dependency may be healthy, bypassed, redundant, or merely correlated with the affected path.
- Should the ontology contain a caused_by property?
- Only with a strict evidence and governance contract. Many systems are safer storing a causal claim entity with mechanism, evidence, alternatives, status, reviewer, and validity rather than a bare edge.
Related guides
Continue within Ontology and operational semantics, or use one of these adjacent diagnostics:
Editorial QA: automated native-English, structure, source-presence, and link checks completed . This record is not an independent expert endorsement. Review boundary.