A taxonomy or ontology for expressing rights and obligations is developed and adopted; policy requires rights and obligations to be captured and recorded; they are held as metadata in a rules repository traceable to their source (contracts, licences, laws and regulations, codes of data ethics, business policies and classifications); they are linked in the catalog to the data assets they govern; and they are exposed so their enforcement can be automated. Rules are expressed as permissions, prohibitions and duties in a limited, consistent vocabulary without free text, ideally in an industry rights expression language (for example the ODRL market data profile) so they travel along the data supply chain. Rights metadata is managed like sensitive metadata: access strictly controlled and every change logged and auditable.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.