Sensitive data is protected at rest, at least in an ad hoc way, using techniques such as authentication, authorisation, encryption and data masking.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.