The client and the conformity assessment body record in the certification agreement what is being certified (a whole age assurance system or a named component) with its boundaries and the contexts of use sought; a component's role in the wider process and its interfaces are stated. An age assurance provider's scope names the system or component with its version, its operating parameters (process limits, prerequisites, connectivity needs, technology dependencies, throttling or exclusions, online or offline operation, what it guards (goods, content, services, venues, spaces), the jurisdictions, and single-use or reusable results), a high-level architecture diagram of its interactions with individuals, intermediaries and relying parties, and the international standards to be used for testing. A relying party's scope covers its organisational footprint and deployment points, the goods or services guarded, its age eligibility rules, its jurisdictions and any other specifications or regulatory obligations it sets. An intermediary's scope names the component or function, its role and responsibilities towards providers, relying parties and individuals, its parameters, jurisdictions and the standards and the attack vectors it must address.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.