Entitlements and access for sensitive data rest with the creator and the owner by default, until an explicit and authoritative grant extends them to others, and access is tracked for all sensitive data. Automation opportunities: default entitlements to creator and owner; track automatically which users access which data and how often and hold it in the catalog; give every owner access to the usage tracking; hold entitlements as metadata usable by any access tool. Certification test steps: confirm the catalog exists with entitlement entries and recurring scanning; report assets with and without entitlements; check that asset privileges map to user entitlements and are reflected in access controls; verify users are active employees granted per asset; confirm assets without entitlements go to remediation; create an asset and confirm access defaults to creator and owner.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.