The organisation has defined, even ad hoc, what it treats as personal information in its business activities and why it collects, uses and holds it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.