The TSF narrows which session security attributes a user is allowed to pick, by rules such as time, location or method of access. One component: FTA_LSA.1 Limitation on scope of selectable attributes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.