Controllers may not process sensitive data without the consumer's consent (or, for a known child, in accordance with COPPA).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.