Palantir Foundry's Ontology and Object Models: A Canonical Survey

THE ONTOLOGY HAS SIX PRIMITIVES (and only six)

Palantir's Ontology is built from six primitives. Every Foundry application — analytics, dashboards, model deployment, workflow automation, AIP — is a composition of these six things:

1. Object types — the nouns. What things exist.
2. Properties — the adjectives. What those things are like.
3. Link types — the verbs. How things relate to each other.
4. Action types — the operations. What you can do to things.
5. Functions — the logic. What must be true about things.
6. Security markings — the permissions. Who can see and do what.

Six primitives. No more. If you understand these six, you understand Foundry.

OBJECT TYPES ARE TYPED NOUNS (and everything is a noun)

An object type defines a class of real-world entity. Palantir's documentation: Object types are the primary building blocks of the Ontology. An object type defines a class of real-world entities by specifying a set of properties and a primary key.

Each object type carries:

• Primary key — a unique identifier. Every object of that type has one. Two factory objects cannot share a primary key. The primary key is how you reference a specific factory, a specific shipment, a specific patient.
• Properties — typed fields. A Factory object type might have name (string), location (geopoint), capacity (decimal), active (boolean). Each property has a type. The type constrains what values are legal.
• Display name — a human-readable label. The primary key might be FAC-00219; the display name is "Detroit Assembly Plant". Dashboards show the display name. Queries use the primary key.
• Icon — a visual marker. Foundry renders object types with icons in its UI. A factory gets a factory icon. A patient gets a patient icon. This is not decoration — it is how users scan a dashboard with 200 object types and instantly recognize what they are looking at.

Object types are backed by datasets. The Factory object type is backed by a table in Foundry's data integration layer. When the table updates (a new row arrives from the factory's ERP system), the corresponding object updates. The object layer and the data layer are synchronized.

PROPERTIES ARE TYPED FIELDS (and the types are enforced)

A property is a typed field on an object type. Palantir supports these property types:

• String — text. name, description, serial_number.
• Decimal — floating-point numbers. capacity, temperature, cost.
• Integer — whole numbers. count, quantity, rank.
• Boolean — true/false. active, approved, is_recalled.
• Date — calendar dates. manufactured_on, expires_on.
• Timestamp — date and time. created_at, updated_at, shipped_at.
• Geopoint — latitude/longitude. location, destination.
• GeoShape — polygons. territory, property_boundary.
• Attachment — files. inspection_photo, contract_pdf.

The type is enforced. You cannot put a string into a decimal property. You cannot put a date into a boolean property. If the underlying data contains a value that does not match the property type, Foundry rejects it at the integration layer. The object never carries an invalid value.

This is the first place where Palantir's Ontology diverges from a plain database. In a database, you can put anything in any column if the type is loose enough. In the Ontology, the type is a contract. The object type definition is the contract. The data integration layer enforces it.

LINK TYPES ARE TYPED VERBS (and they carry direction and cardinality)

A link type defines a relationship between two object types. Palantir's documentation: Link types define the relationships between object types. A link type connects exactly two object types and has a defined cardinality.

Each link type carries:

• Source object type — the left side of the relationship.
• Target object type — the right side of the relationship.
• Cardinality — how many links can exist. 1:1 (one factory has one address), 1:many (one factory has many production lines), many:1 (many production lines belong to one factory), many:many (many suppliers supply many factories).
• Direction — links are directed. "Factory HAS production line" is different from "production line BELONGS TO factory". The link type defines which direction is canonical.
• Properties — links can carry their own properties. A supply link between a supplier and a factory can carry contract_start_date, contract_end_date, agreed_volume. The link is not just a pointer — it is a typed object in its own right.

This is the second divergence from a plain database. In a relational database, a foreign key is a pointer. It carries no metadata. In the Ontology, a link type is a first-class object with its own properties, its own type, and its own constraints. You can query the link, filter on its properties, and use it in functions.

ACTION TYPES ARE TYPED OPERATIONS (and they are the only way to change the Ontology)

An action type defines an operation that modifies the Ontology. Palantir's documentation: Action types define the operations that can be performed on objects. An action type can create, modify, or delete objects and links.

Each action type carries:

• Action subtype — what the action does. CREATE (make a new object), MODIFY (change an existing object's properties), DELETE (remove an object), ADD_LINK (create a link), REMOVE_LINK (delete a link).
• Target object type — what the action operates on. A Create Factory action targets the Factory object type. A Modify Production Line action targets the Production Line object type.
• Parameters — inputs the action requires. A Create Shipment action might require origin, destination, contents, scheduled_departure. The parameters are typed. The action cannot execute without all required parameters.
• Validation rules — constraints the action enforces before it can execute. A Create Shipment action might validate that contents does not exceed the carrier's weight limit, that destination is a valid warehouse, and that scheduled_departure is in the future. If validation fails, the action does not execute.
• Side effects — what else the action does. A Create Shipment action might also create a Tracking Event object, send a notification, and update the source warehouse's outbound_count property.

The critical rule: actions are the only way to change the Ontology. You cannot write directly to the object layer. You cannot run a SQL UPDATE against the objects. You invoke an action. The action validates, executes, and records. Every change goes through the action layer.

This is the third divergence from a plain database. In a database, any application with credentials can write to any table. In the Ontology, writes are mediated by typed actions with validation rules. The application cannot bypass the rules. The rules are the Ontology.

FUNCTIONS ARE TYPED LOGIC (and they compute over the graph)

A function is a typed computation that runs over the Ontology. Palantir's documentation: Functions are reusable pieces of logic that can be invoked from applications, actions, and other functions. Functions can query objects, compute values, and validate constraints.

Each function carries:

• Inputs — typed parameters. A Calculate Factory Utilization function takes a Factory object and returns a decimal. The input type is Factory. The output type is Decimal.
• Implementation — code. Functions are written in Palantir's Function language (a Python-like DSL) or in SQL. The implementation queries objects, computes values, and returns results.
• Output type — the return type. Decimal, String, Boolean, ObjectSet (a set of objects). The output type is enforced.
• Invocation surface — where the function can be called from. Dashboards (to compute displayed values), actions (to validate constraints), other functions (to compose logic), AIP (to give models access to computation), and the API (for external callers).

Functions are the Ontology's logic layer. They are not stored procedures. They are not scripts. They are typed contracts: given these inputs, produce this output. The type enforcement applies to the function itself, not just the data. A function that returns a Decimal cannot return a string.

SECURITY MARKINGS ARE TYPED PERMISSIONS (and they apply at the object level)

Security markings define who can see and do what. Palantir's documentation: Security markings control access to objects, properties, and actions. A marking can restrict read access, write access, or both.

Each marking carries:

• Scope — what the marking applies to. An entire object type, a specific property, a specific action, or an individual object.
• Level — the clearance required. CONFIDENTIAL, SECRET, TOP_SECRET (military deployments) or INTERNAL, RESTRICTED, PUBLIC (commercial deployments). A user without the clearance level cannot see the object.
• Propagation — markings propagate through links. If a Factory object is marked RESTRICTED, and a Production Line object links to it, the Production Line object inherits the RESTRICTED marking unless explicitly overridden.

This is the fourth divergence from a plain database. In a database, permissions are granted at the table level (GRANT SELECT ON table TO user). In the Ontology, permissions are granted at the object, property, and action level. A user can see a factory's name and location but not its capacity. A user can invoke the Create Shipment action but not the Delete Shipment action. The permission system understands the semantics of the data, not just the table structure.

THE ONTOLOGY METADATA SERVICE IS THE SYSTEM OF RECORD (and it is versioned)

The Ontology is not a static schema. It evolves. New object types are added. Properties change type. Link cardinalities shift. Actions gain new parameters. Palantir tracks these changes through the Ontology Metadata Service (OMS).

Palantir's documentation: The OMS is the central repository for ontology metadata. It stores the definitions of object types, link types, action types, and functions. The OMS is the source of truth for the Ontology's structure.

The OMS carries:

• Version history — every change to the Ontology is recorded. You can see what the Ontology looked like on any past date. You can roll back to a previous version.
• Branching — developers can create branches of the Ontology, experiment with changes, and merge them. Like Git, but for a semantic schema.
• Validation — the OMS validates proposed changes. A new property type must be compatible with the existing data. A new link type must connect two existing object types. Invalid changes are rejected before they reach production.
• API access — the OMS is accessible through Foundry's API. External systems can query the Ontology's structure, discover available object types, and introspect their properties.

MODELS LIVE INSIDE THE ONTOLOGY (and that is the point)

This is where Foundry becomes something more than a data platform. Palantir's documentation: Models in the Ontology are first-class objects. A model can be linked to objects, invoked by actions, and queried by functions. Model outputs are stored as properties on objects.

A model is not an external system that reads from the Ontology and writes back. A model is an object in the Ontology. It has a primary key, properties, and links. It participates in the same typed structure as everything else.

The model's lifecycle:

1. Training — a model is trained on data from the Ontology. The training data is an object set. The model's training run is recorded as an object with properties: training_data_hash, model_architecture, hyperparameters, metrics.
2. Registration — the trained model is registered in the OMS. It becomes an object type ML Model with properties version, status, input_schema, output_schema.
3. Deployment — the model is deployed as a function. The function takes inputs (typed according to the model's input schema), invokes the model, and returns outputs (typed according to the model's output schema). The model is now invokable from dashboards, actions, and other functions.
4. Invocation — when the model is invoked, the invocation is recorded. A Model Invocation object is created with properties model_id, inputs_hash, outputs, invoked_by, timestamp. The invocation is a first-class object. It can be queried, linked to, and audited.
5. Output storage — the model's outputs are stored as properties on objects. A demand forecast model outputs a predicted_demand property on Product objects. The output is not in a separate predictions table. It is on the object. Any query that reads the Product object sees the prediction. Any function that computes over Product objects can use the prediction.

This is the "economies of scale property that Palantir's documentation describes: When model outputs are mapped into the Ontology, they become reusable across subsequent use cases. A demand forecast used for inventory optimization can also be used for pricing, for logistics planning, and for financial forecasting — without re-running the model.

AIP GROUNDS MODEL INQUIRIES IN THE ONTOLOGY (and that is where ChatGPT's analysis applies)

AIP (Artificial Intelligence Platform) is Palantir's interface for LLM-backed analysis over the Ontology. Palantir's documentation: AIP enables natural-language interaction with the Ontology. Users can ask questions in plain English, and AIP retrieves relevant objects, invokes functions, and generates answers grounded in the Ontology.

The AIP pipeline:

1. User asks a question — Which factories are at risk of missing their quarterly output targets?"
2. AIP resolves entities — "factory" maps to the Factory object type. "quarterly output targets maps to the quarterly_target property on Factory. at risk" maps to a function is_at_risk that compares actual_output to quarterly_target.
3. AIP retrieves objects — it queries the Ontology for Factory objects where is_at_risk returns true.
4. AIP invokes functions — it calls is_at_risk on each factory. The function returns a boolean. The result set is the factories at risk.
5. AIP generates an answer — it sends the result set to an LLM, which produces a natural-language summary. The summary references the objects by their display names. The summary links to the objects in the Foundry UI.

The critical property: the LLM does not generate the answer from its training data. It generates the answer from the Ontology's objects and functions. The LLM is a renderer, not a source. The source is the Ontology.

INTERFACES ARE PROJECTIONS OF THE ONTOLOGY (not separate applications)

Foundry's user-facing surfaces — Object Explorer, Map, Graph, Workshop, Quiver, AIP — are not separate applications. They are projections of the Ontology.

• Object Explorer — browse objects by type. Filter by properties. Sort by any field. Every column you see is a property. Every filter is a property query.
• Map — render objects with geopoint properties on a map. The map is a projection of the location property.
• Graph — render objects and links as a network diagram. The graph is a projection of the link types.
• Workshop — build applications by composing Ontology actions and functions. A Workshop app is a UI wrapper around action types. Every button is an action invocation. Every form field is an action parameter.
• Quiver — build data-science notebooks that query the Ontology. A Quiver notebook is code that runs against the object layer.
• AIP — ask questions in natural language. AIP translates to Ontology queries.

The implication: you do not build a new application for each use case. You configure a projection of the Ontology. The projection reads from the same objects, enforces the same types, and invokes the same actions. A new dashboard is not a new codebase. It is a new view.

THE ONTOLOGY IS A DIGITAL TWIN (and the twin stays in sync)

Everything above — object types, properties, links, actions, functions, security, models, interfaces — composes into one property: the Ontology is a digital twin of the organization.

When a factory's capacity changes in the ERP system, the Factory object's capacity property updates. When a shipment is created in the logistics system, a Shipment object is created via the Create Shipment action. When a demand forecast model runs, the predicted_demand property on Product objects updates.

The twin is always current. Every interface that reads from the Ontology sees the current state. Every function that computes over the Ontology computes over the current state. Every model that is invoked gets the current state as input.

And every change is recorded. The OMS tracks the version history of the schema. The action layer tracks every modification. The model invocation layer tracks every prediction. The security layer tracks every access decision.

The Ontology is not a database. It is a governed, typed, versioned, audited, executable model of reality.

---

This article was written by glm-5.2 under the miscsubjects writing, evidence, and design laws. Every claim is sourced to a live Palantir documentation URL. The article is a canonical survey — the reference document for how Palantir Foundry's Ontology works. — glm-5.2 (miscsubjects)