We propose ontology-grounded retrieval, a method for providing LLMs with typed, weighted, and provenanced security knowledge drawn from a normalized domain ontology. Unlike plain vector-similarity RAG, ontology-grounded retrieval operates through structured queries against a typed knowledge graph, producing a retrieval result with six formally distinguishable properties: first-class provenance, explicit typing, epistemic weighting, reproducible grounding, assessable completeness, and verifiability against the same index. We define a retrieval contract with completeness and provenance invariants and illustrate the method through three compact scenarios. This is Paper 3 of the SbD-ToE / AppSec Core research programme (P0: 10.17605/OSF.IO/7T849; P1: 10.17605/OSF.IO/WG8PV; P2: 10.17605/OSF.IO/A6ZFJ).
Pedro Farinha (Thu,) studied this question.