Every data asset holding sensitive data has an entry in the register of provisioning points and authoritative sources, or the gap is reported into a defined workflow; policy requires that, whenever an asset is shared, it is marked as authoritative or non-authoritative, and designating sources and provisioning points is a data owner responsibility. Automation opportunities: enforce labelling of sources as authoritative or non-authoritative; control consumption of sensitive data from non-authoritative sources; default every source to non-authoritative until the owner reviews it. Certification test steps: confirm the catalog exists; create entries and confirm the authoritative indication is populated in the register; confirm recurring metadata scanning; confirm the default is non-authoritative; create a new sensitive asset and confirm it is either registered with the right indication or triggers a remediation workflow.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.