The volume and nature of data collected and processed must match the declared purposes and the owner's powers, and the owner or operator may obtain from the subject only the data needed to achieve the processing purposes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.