When a data holder receives a rule 4.4 request with no current authorisation, and reasonably believes it was made by an accredited person on behalf of an eligible consumer, it must, if considering disclosing voluntary consumer data, ask the consumer to authorise that disclosure, and must, subject to rule 4.7, ask the consumer to authorise disclosure of the requested required consumer data, in each case in accordance with Division 4.4 and the data standards (both civil penalty).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.