For a toy, wherever a privacy function lets children reach external content and ACM-1 requires that access to be controlled, the mechanism is set out of the box so that the content children can reach through the function comes only from authorised entities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.