s.10(3)-(5): for programs that perform specified functions (e.g. collecting personal information, changing settings, interfering with control), enhanced, separate disclosure of the function, purpose and impact is required before consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.