Assessor verifies on sample devices that standard user accounts cannot install software or perform administrative tasks without separate credentials.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.