Cross-border provision of PI requires one of: a CAC security assessment; a professional-body personal-information protection certification; a standard contract with the overseas recipient on CAC terms; or other conditions in law/CAC rules.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.