A controller may not process sensitive data without first obtaining the consumer's consent (or, for a known child, consent in accordance with COPPA).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.