An SR data request by a consumer is made to the primary data holder through its direct request service. The primary data holder must, using the secondary data holder's service and the data standards, request any SR data it needs (civil penalty); the secondary data holder, if it chooses to disclose, must do so under the data standards, and if it refuses must notify the primary data holder (both civil penalty). Rules 3.4 and 3.5 then apply to the primary data holder as though it held the SR data, except that it is not required to disclose SR data the secondary data holder refused.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.