Consent must be a clear affirmative act, freely given, specific, informed and unambiguous (not via dark patterns); controllers must provide a mechanism to revoke consent and cease processing within 15 days of revocation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.