The client defines the item's boundaries so that certification can be repeated: an architecture diagram showing the item, its interfaces to other systems, to components and to intermediaries, the flow of data and results between parties and any external dependencies; documentary identification by name, version or deployment reference, release date and the jurisdictions and contexts covered; a statement of what functions, processes or methods are inside and outside certification together with the assumptions, prerequisites and conditions for operating within the certified scope; and, where relevant, the standards each component inside the boundary is analysed against. The certification agreement records the boundaries, and the certificate and schedule state them with the version certified.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.