A use case assessed as out of scope may be adopted provided the agency continues to meet its other obligations, such as privacy and security. The agency must then assess whether the use case has come into scope whenever the solution's scope, usage or operation materially changes, and if it has, must apply the policy's applicable actions: an accountable use case owner, a register entry, an impact assessment with treatments, monitoring and, where rated high risk, the governance and reporting steps. This closes the loop on the scoping assessment, which would otherwise be a one-time decision for tools whose use grows over time.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.