Effective, consistent obfuscation techniques are defined for data security concerns with criteria for choosing among them (data utility and referential integrity needs, sensitivity classification, location of the store, the perimeters at which elements must be obfuscated, and which technique or combination fits each store or element). The techniques are encryption, masking (partial and full redaction, generalization, stochastic perturbation, substitution and shuffling) and tokenization, the recommended default for sensitive values that are not redacted. Reversibility is tightly controlled per element, obfuscation is applied consistently across linked data sets, quasi-identifiers that could combine to identify a person are obfuscated, and obfuscated data stays traceable with its dissemination controlled. Data is obfuscated at the earliest point, sensitive data does not move to lower environments unless approved and obfuscated at migration, detokenization is exceptional, explicitly authorized and logged, mapping tables are secured, and different systems receive different tokens; functionality flags sensitive data that is not obfuscated.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.