The TSF keeps, for each user, the security attributes beyond identity that it needs to enforce the SFRs, such as roles, clearances or group memberships. One component: FIA_ATD.1 User attribute definition.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.