A person who wants to receive customer data as an authorised person, or business data as an approved recipient, can be required by data regulations to satisfy conditions for authorisation or approval decided by a decision-maker, which can suspend or revoke the decision and use monitoring powers including requirements to provide documents or information. Once it receives data, a third party recipient can be required to use specified interfaces and standards, contribute to their running, process the data only as the regulations allow, impose the regulations' obligations or its own conditions on anyone it passes the data to, keep records of data received, publish information about customers' rights and its activities, and run complaints procedures. Regulations must give affected persons rights of review or appeal against a decision-maker.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.