Controllers may refuse suppression in defined cases including legal duty to retain, contractual obligations, or where suppression would prejudice legitimate interests of third parties. Refusal must be reasoned.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.