At aircraft level the applicant defines the security scope: the assets (the logical and physical resources that support airworthiness, such as systems, functions, items, interfaces, data, information and processes), the security perimeter that bounds the assets' internal security context, the interfaces to external systems and networks, and the security environment, the external context of security assumptions outside the developer's control that the assessment relies on (roles, access, responsibilities, external measures, threat sources).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.