When assessing a service that government entities intend to authorise, the assessor requests the provider's recommendations for consumer implementations, checks that they are effective in meeting their intent, and includes them in the relevant section of the report (examples: a consumer-configurable lockbox preventing provider administrator access to agency data without authorisation, or a region lock keeping all data in Australia).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.