Access rights are reviewed and adjusted at intervals so they match current roles and duties; only authorised administrative roles can create, change or delete accounts and roles or reach privileged functions and applications; and user, administrative and non-person accounts are provisioned with no more access than their defined operational function needs. Marked across the technical domains.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.