Secure the application code layer: secure coding, dependency management, secrets handling and application-level controls (the layer with the most direct control for the organisation).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.