A policy sets the principles and decision rights for where cloud data may be stored; for each cloud data asset the catalog defines and records metadata on its storage location, its jurisdiction and its sovereignty requirements; sovereignty requirements and restrictions are understood, agreed and written into data sharing agreements; the sovereignty impact of relocating resources or data, changing access or changing processes is managed; and a process assesses changes in sovereignty regulation and requirements. The framework classifies rules by source (governments, industry regulators, contracts) and by action, and lists rule types: no-transfer, non-personal data restrictions, outsourcing restrictions, consent restrictions, infrastructure rules, local copy rules and equivalent-standard allowances. Practitioners must know how providers deal with backups (online and offline), long-term storage, distribution, replication, caching and temporary persistence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.