The authorizer decides on the package, chiefly on the acceptability of residual risk and outstanding deficiencies, to grant authorization to operate with or without conditions or to deny it. Authorization is a continuing state, not a term that expires, kept through continuous monitoring and revocable after a major event; it is conveyed by a formal statement giving the start date and conditions, and a denial returns the project to the point where the cause can be fixed. ISSIP outputs can be assembled into a system security plan where the profile requires one.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.