Processing is legitimate where the data subject consents, unless waived for legal obligation, public interest, contract, or vital interests.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.