From 924afdc2a18263628a4a6068cc5c2f447ef8222e Mon Sep 17 00:00:00 2001
From: coodos <me@merul.org>
Date: Wed, 7 Oct 2026 23:18:59 +0800
Subject: [PATCH 1/3] feat(ontology): company directors, roles, delegations,
 delegated signatures and shareholdings

---
 services/ontology/schemas/company.json        |  38 ++++
 .../ontology/schemas/delegatedSignature.json  |  71 ++++++++
 services/ontology/schemas/delegation.json     | 170 ++++++++++++++++++
 services/ontology/schemas/role.json           | 127 +++++++++++++
 services/ontology/schemas/shareholding.json   | 108 +++++++++++
 5 files changed, 514 insertions(+)
 create mode 100644 services/ontology/schemas/delegatedSignature.json
 create mode 100644 services/ontology/schemas/delegation.json
 create mode 100644 services/ontology/schemas/role.json
 create mode 100644 services/ontology/schemas/shareholding.json

diff --git a/services/ontology/schemas/company.json b/services/ontology/schemas/company.json
index 227d69ec7..f245c7a91 100644
--- a/services/ontology/schemas/company.json
+++ b/services/ontology/schemas/company.json
@@ -18,6 +18,16 @@
       "type": "string",
       "description": "MetaEnvelope ID of the canonical GroupManifest"
     },
+    "directors": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^@.+"
+      },
+      "description": "eNames of the directors. Any one director may create roles and grant delegations; only an existing director may change this list. The creator is the first director."
+    },
     "legalName": {
       "type": "string",
       "description": "Registered legal name"
@@ -62,6 +72,34 @@
     "updatedAt": {
       "type": "string",
       "format": "date-time"
+    },
+    "authorization": {
+      "type": "object",
+      "description": "The wallet signature, over this record's canonical form (`w3ds-grant/v1`), of the director who set or last changed `directors`: the creator for the first version, then an existing director. The eVault verifies it before accepting the write.",
+      "properties": {
+        "signerEName": {
+          "type": "string",
+          "pattern": "^@.+"
+        },
+        "signedPayload": {
+          "type": "string",
+          "description": "The exact canonical string that was signed"
+        },
+        "signature": {
+          "type": "string"
+        },
+        "signedAt": {
+          "type": "string",
+          "format": "date-time"
+        }
+      },
+      "required": [
+        "signerEName",
+        "signedPayload",
+        "signature",
+        "signedAt"
+      ],
+      "additionalProperties": false
     }
   },
   "required": [
diff --git a/services/ontology/schemas/delegatedSignature.json b/services/ontology/schemas/delegatedSignature.json
new file mode 100644
index 000000000..018837385
--- /dev/null
+++ b/services/ontology/schemas/delegatedSignature.json
@@ -0,0 +1,71 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "schemaId": "e2736a06-176e-4004-8fda-b40b9a132669",
+  "title": "DelegatedSignature",
+  "domain": "governance",
+  "description": "Audit record of a signature made for a company under a Delegation. Written to the company's eVault by the platform that verified it.",
+  "type": "object",
+  "properties": {
+    "companyEName": {
+      "type": "string",
+      "pattern": "^@.+"
+    },
+    "signerEName": {
+      "type": "string",
+      "pattern": "^@.+"
+    },
+    "delegationId": {
+      "type": "string",
+      "description": "MetaEnvelope id of the Delegation used"
+    },
+    "title": {
+      "type": "string",
+      "description": "The signer's title at signing time"
+    },
+    "scope": {
+      "type": "string",
+      "pattern": "^(ontology:[0-9a-fA-F-]{36}|@[^\\s:]+:[a-z][a-z0-9-]*)$",
+      "description": "`ontology:<schemaId>` or a platform-declared keyword `@<platform-eName>:<keyword>`"
+    },
+    "documentHash": {
+      "type": "string",
+      "description": "Hash of what was signed, as named in the payload"
+    },
+    "session": {
+      "type": "string"
+    },
+    "signedPayload": {
+      "type": "string",
+      "description": "The exact `w3ds-sign/v1` string the wallet signed"
+    },
+    "signature": {
+      "type": "string"
+    },
+    "platformEName": {
+      "type": "string",
+      "pattern": "^@.+",
+      "description": "Platform that requested, verified and recorded the signature"
+    },
+    "signedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "createdAt": {
+      "type": "string",
+      "format": "date-time"
+    }
+  },
+  "required": [
+    "companyEName",
+    "signerEName",
+    "delegationId",
+    "scope",
+    "documentHash",
+    "signedPayload",
+    "signature",
+    "platformEName",
+    "signedAt",
+    "createdAt"
+  ],
+  "additionalProperties": false
+}
diff --git a/services/ontology/schemas/delegation.json b/services/ontology/schemas/delegation.json
new file mode 100644
index 000000000..04a236f59
--- /dev/null
+++ b/services/ontology/schemas/delegation.json
@@ -0,0 +1,170 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "schemaId": "0b2f15d8-c3f9-4dba-b959-5cfa11272dae",
+  "title": "Delegation",
+  "domain": "governance",
+  "description": "Lets a person sign for a company within some scopes. Either assigns a Role (granted by a director) or narrows a parent Delegation (re-delegation, only when the parent allows it). Lives in the company's eVault and is public so verifiers can check it.",
+  "type": "object",
+  "properties": {
+    "companyEName": {
+      "type": "string",
+      "pattern": "^@.+",
+      "description": "eName of the company eVault"
+    },
+    "delegateEName": {
+      "type": "string",
+      "pattern": "^@.+",
+      "description": "Who may sign for the company"
+    },
+    "roleId": {
+      "type": "string",
+      "description": "MetaEnvelope id of the Role this assigns"
+    },
+    "parentDelegationId": {
+      "type": "string",
+      "description": "MetaEnvelope id of the Delegation this narrows"
+    },
+    "title": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 80
+    },
+    "scopes": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^(ontology:[0-9a-fA-F-]{36}|@[^\\s:]+:[a-z][a-z0-9-]*)$",
+        "description": "`ontology:<schemaId>` or a platform-declared keyword `@<platform-eName>:<keyword>`"
+      },
+      "description": "Must be a subset of the role's or parent's scopes"
+    },
+    "appLimits": {
+      "type": "object",
+      "description": "May only tighten the parent's app limits"
+    },
+    "mayRedelegate": {
+      "type": "boolean"
+    },
+    "validFrom": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "validUntil": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "format": "date-time"
+    },
+    "grantedBy": {
+      "type": "string",
+      "pattern": "^@.+",
+      "description": "The director, or the parent delegation's delegate"
+    },
+    "status": {
+      "type": "string",
+      "enum": [
+        "active",
+        "revoked"
+      ]
+    },
+    "revokedAt": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "format": "date-time"
+    },
+    "revokedBy": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "revocationReason": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "enum": [
+        "revoked",
+        "cascade",
+        null
+      ],
+      "description": "`cascade` when revoked because a role or parent was revoked or narrowed"
+    },
+    "createdAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "updatedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "authorization": {
+      "type": "object",
+      "description": "The wallet signature of the grantor over this record's canonical form (`w3ds-grant/v1`). The eVault verifies it before accepting the write.",
+      "properties": {
+        "signerEName": {
+          "type": "string",
+          "pattern": "^@.+"
+        },
+        "signedPayload": {
+          "type": "string",
+          "description": "The exact canonical string that was signed"
+        },
+        "signature": {
+          "type": "string"
+        },
+        "signedAt": {
+          "type": "string",
+          "format": "date-time"
+        }
+      },
+      "required": [
+        "signerEName",
+        "signedPayload",
+        "signature",
+        "signedAt"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "required": [
+    "companyEName",
+    "delegateEName",
+    "title",
+    "scopes",
+    "mayRedelegate",
+    "grantedBy",
+    "status",
+    "createdAt",
+    "updatedAt",
+    "authorization"
+  ],
+  "oneOf": [
+    {
+      "required": [
+        "roleId"
+      ],
+      "not": {
+        "required": [
+          "parentDelegationId"
+        ]
+      }
+    },
+    {
+      "required": [
+        "parentDelegationId"
+      ],
+      "not": {
+        "required": [
+          "roleId"
+        ]
+      }
+    }
+  ],
+  "additionalProperties": false
+}
diff --git a/services/ontology/schemas/role.json b/services/ontology/schemas/role.json
new file mode 100644
index 000000000..05e706c09
--- /dev/null
+++ b/services/ontology/schemas/role.json
@@ -0,0 +1,127 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "schemaId": "65fd0e21-34b9-43ef-be76-c5b39727010e",
+  "title": "Role",
+  "domain": "governance",
+  "description": "A titled bundle of signing authority a company hands out, e.g. 'Head of Finance'. Lives in the company's eVault and is public so verifiers can check it. Created and changed only by a director.",
+  "type": "object",
+  "properties": {
+    "companyEName": {
+      "type": "string",
+      "pattern": "^@.+",
+      "description": "eName of the company eVault"
+    },
+    "title": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 80,
+      "description": "Easy to remember title shown when signing"
+    },
+    "description": {
+      "type": "string"
+    },
+    "scopes": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {
+        "type": "string",
+        "pattern": "^(ontology:[0-9a-fA-F-]{36}|@[^\\s:]+:[a-z][a-z0-9-]*)$",
+        "description": "`ontology:<schemaId>` or a platform-declared keyword `@<platform-eName>:<keyword>`"
+      },
+      "description": "What holders may sign for the company. Core scopes are never accepted."
+    },
+    "appLimits": {
+      "type": "object",
+      "description": "Platform-specific limits (e.g. maxAmount), enforced by the platform that declared them"
+    },
+    "mayRedelegate": {
+      "type": "boolean",
+      "description": "Whether holders may pass on a narrower part of this role"
+    },
+    "validFrom": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "validUntil": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "format": "date-time"
+    },
+    "status": {
+      "type": "string",
+      "enum": [
+        "active",
+        "revoked"
+      ]
+    },
+    "revokedAt": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "format": "date-time"
+    },
+    "revokedBy": {
+      "type": [
+        "string",
+        "null"
+      ]
+    },
+    "createdBy": {
+      "type": "string",
+      "pattern": "^@.+",
+      "description": "The director who created the role"
+    },
+    "createdAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "updatedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "authorization": {
+      "type": "object",
+      "description": "The wallet signature of the director making this change over this record's canonical form (`w3ds-grant/v1`). The eVault verifies it before accepting the write.",
+      "properties": {
+        "signerEName": {
+          "type": "string",
+          "pattern": "^@.+"
+        },
+        "signedPayload": {
+          "type": "string",
+          "description": "The exact canonical string that was signed"
+        },
+        "signature": {
+          "type": "string"
+        },
+        "signedAt": {
+          "type": "string",
+          "format": "date-time"
+        }
+      },
+      "required": [
+        "signerEName",
+        "signedPayload",
+        "signature",
+        "signedAt"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "required": [
+    "companyEName",
+    "title",
+    "scopes",
+    "mayRedelegate",
+    "status",
+    "createdBy",
+    "createdAt",
+    "updatedAt",
+    "authorization"
+  ],
+  "additionalProperties": false
+}
diff --git a/services/ontology/schemas/shareholding.json b/services/ontology/schemas/shareholding.json
new file mode 100644
index 000000000..b9c866e36
--- /dev/null
+++ b/services/ontology/schemas/shareholding.json
@@ -0,0 +1,108 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "schemaId": "6382a144-5c28-450e-bf47-e37c747791c2",
+  "title": "Shareholding",
+  "domain": "governance",
+  "description": "A holding of a company's shares. Recorded by a director; carries no signing authority.",
+  "type": "object",
+  "properties": {
+    "companyEName": {
+      "type": "string",
+      "pattern": "^@.+"
+    },
+    "holderEName": {
+      "type": "string",
+      "pattern": "^@.+",
+      "description": "The holder, when they have an eName"
+    },
+    "holderName": {
+      "type": "string",
+      "description": "Display or legal name of the holder"
+    },
+    "shareClass": {
+      "type": "string",
+      "minLength": 1,
+      "description": "e.g. ordinary, preference"
+    },
+    "shares": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "acquiredAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "status": {
+      "type": "string",
+      "enum": [
+        "active",
+        "disposed"
+      ]
+    },
+    "disposedAt": {
+      "type": [
+        "string",
+        "null"
+      ],
+      "format": "date-time"
+    },
+    "createdAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "updatedAt": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "authorization": {
+      "type": "object",
+      "description": "The wallet signature of the director recording it over this record's canonical form (`w3ds-grant/v1`). The eVault verifies it before accepting the write.",
+      "properties": {
+        "signerEName": {
+          "type": "string",
+          "pattern": "^@.+"
+        },
+        "signedPayload": {
+          "type": "string",
+          "description": "The exact canonical string that was signed"
+        },
+        "signature": {
+          "type": "string"
+        },
+        "signedAt": {
+          "type": "string",
+          "format": "date-time"
+        }
+      },
+      "required": [
+        "signerEName",
+        "signedPayload",
+        "signature",
+        "signedAt"
+      ],
+      "additionalProperties": false
+    }
+  },
+  "required": [
+    "companyEName",
+    "shareClass",
+    "shares",
+    "status",
+    "createdAt",
+    "updatedAt",
+    "authorization"
+  ],
+  "anyOf": [
+    {
+      "required": [
+        "holderEName"
+      ]
+    },
+    {
+      "required": [
+        "holderName"
+      ]
+    }
+  ],
+  "additionalProperties": false
+}

From 11799772424e290ba36e7d3665c350ddec8bf936 Mon Sep 17 00:00:00 2001
From: coodos <me@merul.org>
Date: Wed, 7 Oct 2026 23:25:32 +0800
Subject: [PATCH 2/3] fix(ontology): tighten scope, reference, holder, director
 and revocation validation

---
 services/ontology/schemas/company.json        |  7 +-
 .../ontology/schemas/delegatedSignature.json  |  2 +-
 services/ontology/schemas/delegation.json     | 82 ++++++++++++++-----
 services/ontology/schemas/role.json           | 44 +++++++++-
 services/ontology/schemas/shareholding.json   | 37 ++++++++-
 5 files changed, 147 insertions(+), 25 deletions(-)

diff --git a/services/ontology/schemas/company.json b/services/ontology/schemas/company.json
index f245c7a91..54bfbfdee 100644
--- a/services/ontology/schemas/company.json
+++ b/services/ontology/schemas/company.json
@@ -108,5 +108,10 @@
     "createdAt",
     "updatedAt"
   ],
-  "additionalProperties": false
+  "additionalProperties": false,
+  "dependencies": {
+    "directors": [
+      "authorization"
+    ]
+  }
 }
diff --git a/services/ontology/schemas/delegatedSignature.json b/services/ontology/schemas/delegatedSignature.json
index 018837385..ccec2ae19 100644
--- a/services/ontology/schemas/delegatedSignature.json
+++ b/services/ontology/schemas/delegatedSignature.json
@@ -24,7 +24,7 @@
     },
     "scope": {
       "type": "string",
-      "pattern": "^(ontology:[0-9a-fA-F-]{36}|@[^\\s:]+:[a-z][a-z0-9-]*)$",
+      "pattern": "^(ontology:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|@[^\\s:]+:[a-z][a-z0-9-]*)$",
       "description": "`ontology:<schemaId>` or a platform-declared keyword `@<platform-eName>:<keyword>`"
     },
     "documentHash": {
diff --git a/services/ontology/schemas/delegation.json b/services/ontology/schemas/delegation.json
index 04a236f59..7c5fba1d0 100644
--- a/services/ontology/schemas/delegation.json
+++ b/services/ontology/schemas/delegation.json
@@ -18,11 +18,13 @@
     },
     "roleId": {
       "type": "string",
-      "description": "MetaEnvelope id of the Role this assigns"
+      "description": "MetaEnvelope id of the Role this assigns",
+      "minLength": 1
     },
     "parentDelegationId": {
       "type": "string",
-      "description": "MetaEnvelope id of the Delegation this narrows"
+      "description": "MetaEnvelope id of the Delegation this narrows",
+      "minLength": 1
     },
     "title": {
       "type": "string",
@@ -35,7 +37,7 @@
       "uniqueItems": true,
       "items": {
         "type": "string",
-        "pattern": "^(ontology:[0-9a-fA-F-]{36}|@[^\\s:]+:[a-z][a-z0-9-]*)$",
+        "pattern": "^(ontology:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|@[^\\s:]+:[a-z][a-z0-9-]*)$",
         "description": "`ontology:<schemaId>` or a platform-declared keyword `@<platform-eName>:<keyword>`"
       },
       "description": "Must be a subset of the role's or parent's scopes"
@@ -144,27 +146,69 @@
     "updatedAt",
     "authorization"
   ],
-  "oneOf": [
+  "additionalProperties": false,
+  "allOf": [
     {
-      "required": [
-        "roleId"
-      ],
-      "not": {
-        "required": [
-          "parentDelegationId"
-        ]
-      }
+      "oneOf": [
+        {
+          "required": [
+            "roleId"
+          ],
+          "not": {
+            "required": [
+              "parentDelegationId"
+            ]
+          }
+        },
+        {
+          "required": [
+            "parentDelegationId"
+          ],
+          "not": {
+            "required": [
+              "roleId"
+            ]
+          }
+        }
+      ]
     },
     {
-      "required": [
-        "parentDelegationId"
-      ],
-      "not": {
+      "if": {
+        "properties": {
+          "status": {
+            "const": "revoked"
+          }
+        },
         "required": [
-          "roleId"
+          "status"
         ]
+      },
+      "then": {
+        "required": [
+          "revokedAt",
+          "revokedBy"
+        ],
+        "properties": {
+          "revokedAt": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "revokedBy": {
+            "type": "string",
+            "pattern": "^@.+"
+          }
+        }
+      },
+      "else": {
+        "properties": {
+          "revokedAt": {
+            "type": "null"
+          },
+          "revokedBy": {
+            "type": "null"
+          }
+        }
       }
     }
-  ],
-  "additionalProperties": false
+  ]
 }
diff --git a/services/ontology/schemas/role.json b/services/ontology/schemas/role.json
index 05e706c09..93da9a84f 100644
--- a/services/ontology/schemas/role.json
+++ b/services/ontology/schemas/role.json
@@ -26,7 +26,7 @@
       "uniqueItems": true,
       "items": {
         "type": "string",
-        "pattern": "^(ontology:[0-9a-fA-F-]{36}|@[^\\s:]+:[a-z][a-z0-9-]*)$",
+        "pattern": "^(ontology:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}|@[^\\s:]+:[a-z][a-z0-9-]*)$",
         "description": "`ontology:<schemaId>` or a platform-declared keyword `@<platform-eName>:<keyword>`"
       },
       "description": "What holders may sign for the company. Core scopes are never accepted."
@@ -123,5 +123,45 @@
     "updatedAt",
     "authorization"
   ],
-  "additionalProperties": false
+  "additionalProperties": false,
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "status": {
+            "const": "revoked"
+          }
+        },
+        "required": [
+          "status"
+        ]
+      },
+      "then": {
+        "required": [
+          "revokedAt",
+          "revokedBy"
+        ],
+        "properties": {
+          "revokedAt": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "revokedBy": {
+            "type": "string",
+            "pattern": "^@.+"
+          }
+        }
+      },
+      "else": {
+        "properties": {
+          "revokedAt": {
+            "type": "null"
+          },
+          "revokedBy": {
+            "type": "null"
+          }
+        }
+      }
+    }
+  ]
 }
diff --git a/services/ontology/schemas/shareholding.json b/services/ontology/schemas/shareholding.json
index b9c866e36..04c821afa 100644
--- a/services/ontology/schemas/shareholding.json
+++ b/services/ontology/schemas/shareholding.json
@@ -17,7 +17,8 @@
     },
     "holderName": {
       "type": "string",
-      "description": "Display or legal name of the holder"
+      "description": "Display or legal name of the holder",
+      "minLength": 1
     },
     "shareClass": {
       "type": "string",
@@ -104,5 +105,37 @@
       ]
     }
   ],
-  "additionalProperties": false
+  "additionalProperties": false,
+  "allOf": [
+    {
+      "if": {
+        "properties": {
+          "status": {
+            "const": "disposed"
+          }
+        },
+        "required": [
+          "status"
+        ]
+      },
+      "then": {
+        "required": [
+          "disposedAt"
+        ],
+        "properties": {
+          "disposedAt": {
+            "type": "string",
+            "format": "date-time"
+          }
+        }
+      },
+      "else": {
+        "properties": {
+          "disposedAt": {
+            "type": "null"
+          }
+        }
+      }
+    }
+  ]
 }

From e515484d309c57e8b72abb65342de1474474b067 Mon Sep 17 00:00:00 2001
From: coodos <me@merul.org>
Date: Wed, 7 Oct 2026 23:31:42 +0800
Subject: [PATCH 3/3] fix(ontology): reject empty references and signatures,
 whitespace eNames and stale revocation reasons

---
 services/ontology/schemas/company.json        | 10 ++++---
 .../ontology/schemas/delegatedSignature.json  | 15 ++++++----
 services/ontology/schemas/delegation.json     | 28 +++++++++++++------
 services/ontology/schemas/role.json           | 14 ++++++----
 services/ontology/schemas/shareholding.json   | 12 ++++----
 5 files changed, 50 insertions(+), 29 deletions(-)

diff --git a/services/ontology/schemas/company.json b/services/ontology/schemas/company.json
index 54bfbfdee..120cea412 100644
--- a/services/ontology/schemas/company.json
+++ b/services/ontology/schemas/company.json
@@ -24,7 +24,7 @@
       "uniqueItems": true,
       "items": {
         "type": "string",
-        "pattern": "^@.+"
+        "pattern": "^@[^\\s]+$"
       },
       "description": "eNames of the directors. Any one director may create roles and grant delegations; only an existing director may change this list. The creator is the first director."
     },
@@ -79,14 +79,16 @@
       "properties": {
         "signerEName": {
           "type": "string",
-          "pattern": "^@.+"
+          "pattern": "^@[^\\s]+$"
         },
         "signedPayload": {
           "type": "string",
-          "description": "The exact canonical string that was signed"
+          "description": "The exact canonical string that was signed",
+          "minLength": 1
         },
         "signature": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "signedAt": {
           "type": "string",
diff --git a/services/ontology/schemas/delegatedSignature.json b/services/ontology/schemas/delegatedSignature.json
index ccec2ae19..4d286b117 100644
--- a/services/ontology/schemas/delegatedSignature.json
+++ b/services/ontology/schemas/delegatedSignature.json
@@ -8,15 +8,16 @@
   "properties": {
     "companyEName": {
       "type": "string",
-      "pattern": "^@.+"
+      "pattern": "^@[^\\s]+$"
     },
     "signerEName": {
       "type": "string",
-      "pattern": "^@.+"
+      "pattern": "^@[^\\s]+$"
     },
     "delegationId": {
       "type": "string",
-      "description": "MetaEnvelope id of the Delegation used"
+      "description": "MetaEnvelope id of the Delegation used",
+      "minLength": 1
     },
     "title": {
       "type": "string",
@@ -36,14 +37,16 @@
     },
     "signedPayload": {
       "type": "string",
-      "description": "The exact `w3ds-sign/v1` string the wallet signed"
+      "description": "The exact `w3ds-sign/v1` string the wallet signed",
+      "minLength": 1
     },
     "signature": {
-      "type": "string"
+      "type": "string",
+      "minLength": 1
     },
     "platformEName": {
       "type": "string",
-      "pattern": "^@.+",
+      "pattern": "^@[^\\s]+$",
       "description": "Platform that requested, verified and recorded the signature"
     },
     "signedAt": {
diff --git a/services/ontology/schemas/delegation.json b/services/ontology/schemas/delegation.json
index 7c5fba1d0..7519d69cf 100644
--- a/services/ontology/schemas/delegation.json
+++ b/services/ontology/schemas/delegation.json
@@ -8,12 +8,12 @@
   "properties": {
     "companyEName": {
       "type": "string",
-      "pattern": "^@.+",
+      "pattern": "^@[^\\s]+$",
       "description": "eName of the company eVault"
     },
     "delegateEName": {
       "type": "string",
-      "pattern": "^@.+",
+      "pattern": "^@[^\\s]+$",
       "description": "Who may sign for the company"
     },
     "roleId": {
@@ -62,7 +62,7 @@
     },
     "grantedBy": {
       "type": "string",
-      "pattern": "^@.+",
+      "pattern": "^@[^\\s]+$",
       "description": "The director, or the parent delegation's delegate"
     },
     "status": {
@@ -111,14 +111,16 @@
       "properties": {
         "signerEName": {
           "type": "string",
-          "pattern": "^@.+"
+          "pattern": "^@[^\\s]+$"
         },
         "signedPayload": {
           "type": "string",
-          "description": "The exact canonical string that was signed"
+          "description": "The exact canonical string that was signed",
+          "minLength": 1
         },
         "signature": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "signedAt": {
           "type": "string",
@@ -186,7 +188,8 @@
       "then": {
         "required": [
           "revokedAt",
-          "revokedBy"
+          "revokedBy",
+          "revocationReason"
         ],
         "properties": {
           "revokedAt": {
@@ -195,7 +198,13 @@
           },
           "revokedBy": {
             "type": "string",
-            "pattern": "^@.+"
+            "pattern": "^@[^\\s]+$"
+          },
+          "revocationReason": {
+            "enum": [
+              "revoked",
+              "cascade"
+            ]
           }
         }
       },
@@ -206,6 +215,9 @@
           },
           "revokedBy": {
             "type": "null"
+          },
+          "revocationReason": {
+            "type": "null"
           }
         }
       }
diff --git a/services/ontology/schemas/role.json b/services/ontology/schemas/role.json
index 93da9a84f..49b33e6f9 100644
--- a/services/ontology/schemas/role.json
+++ b/services/ontology/schemas/role.json
@@ -8,7 +8,7 @@
   "properties": {
     "companyEName": {
       "type": "string",
-      "pattern": "^@.+",
+      "pattern": "^@[^\\s]+$",
       "description": "eName of the company eVault"
     },
     "title": {
@@ -72,7 +72,7 @@
     },
     "createdBy": {
       "type": "string",
-      "pattern": "^@.+",
+      "pattern": "^@[^\\s]+$",
       "description": "The director who created the role"
     },
     "createdAt": {
@@ -89,14 +89,16 @@
       "properties": {
         "signerEName": {
           "type": "string",
-          "pattern": "^@.+"
+          "pattern": "^@[^\\s]+$"
         },
         "signedPayload": {
           "type": "string",
-          "description": "The exact canonical string that was signed"
+          "description": "The exact canonical string that was signed",
+          "minLength": 1
         },
         "signature": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "signedAt": {
           "type": "string",
@@ -148,7 +150,7 @@
           },
           "revokedBy": {
             "type": "string",
-            "pattern": "^@.+"
+            "pattern": "^@[^\\s]+$"
           }
         }
       },
diff --git a/services/ontology/schemas/shareholding.json b/services/ontology/schemas/shareholding.json
index 04c821afa..4a0d20d32 100644
--- a/services/ontology/schemas/shareholding.json
+++ b/services/ontology/schemas/shareholding.json
@@ -8,11 +8,11 @@
   "properties": {
     "companyEName": {
       "type": "string",
-      "pattern": "^@.+"
+      "pattern": "^@[^\\s]+$"
     },
     "holderEName": {
       "type": "string",
-      "pattern": "^@.+",
+      "pattern": "^@[^\\s]+$",
       "description": "The holder, when they have an eName"
     },
     "holderName": {
@@ -61,14 +61,16 @@
       "properties": {
         "signerEName": {
           "type": "string",
-          "pattern": "^@.+"
+          "pattern": "^@[^\\s]+$"
         },
         "signedPayload": {
           "type": "string",
-          "description": "The exact canonical string that was signed"
+          "description": "The exact canonical string that was signed",
+          "minLength": 1
         },
         "signature": {
-          "type": "string"
+          "type": "string",
+          "minLength": 1
         },
         "signedAt": {
           "type": "string",