Only supported, verified software that the organisation has authorised may run, with exceptions kept to a minimum, formally risk-accepted, time-limited, monitored and reviewed; and administrative and management tools are confined to approved software sets run only from known, authorised locations. Marked across the technical domains.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.