Access, identities and credentials are granted according to each asset's protection requirements, the asset owner reviews and approves each access request, privileges are reviewed to find excessive or inappropriate ones and modified as a result, permissions follow least privilege and separation of duties, and identities are proofed before being bound to the credentials they assert.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.