The direct link to the ACS is established only when a challenge is required: in the app channel the SDK connects to the ACS URL from the ARes over TLS with server authentication of the ACS under a commercial CA certificate, and the challenge and response data are encrypted and MACed with the session keys established between ACS and SDK; in the browser channel the browser connects from the iframe to the ACS URL over TLS with server authentication under a commercial CA certificate.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.