Under the pre-approval option, rules 4.5 to 4.7 apply but the data holder must not disclose any, or any further, data once a relevant holder has withdrawn approval on its dashboard. Under co-approval, it must seek the requester's authorisation under rule 4.5 and Division 4.4, then invite the other holders' approval under rule 4A.11, and disclose under rules 4.6 to 4.7 only if all approve or are taken to approve, stopping if a holder later withdraws approval. Under non-disclosure it must refuse to disclose. Where a secondary user requests, all joint holders are the relevant holders.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.