The family states the rules by which the functions implementing an access control policy named under FDP_ACC decide access. One component, FDP_ACF.1 Security attribute based access control, with the security attributes used, the rules that grant access, and any rules that explicitly authorise or deny access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.