Where the agency adopts an API-centric or microservices approach it manages the added attack surface of externally developed code: APIs are versioned by the agency and verified as versioned by providers with time to transition, inputs and outputs are encrypted in transit, access keys identify callers and are secret, disposable and covered by revocation and reissuance policy, authorisation enforces user permissions on every call, telemetry and log collection and their versions are planned for any API offered to customers with rate limits and activity monitoring, permissions to provider and agency APIs are set with care, microservices communicate through an API gateway and follow the pipeline, and a service mesh with a decoupled control plane acts as certificate authority (never a self-signed certificate in production) so all service traffic is encrypted, with attribute-based authorisation and end-user authentication enforced at the sidecar proxies under the reference monitor principles of invocation on every access, modification protection and verified correctness.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.