Before a new or changed application goes live, it passes through the architecture review process, which assesses its security.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.