For a toy, every ACM-1 mechanism that governs a child's access to a security or privacy asset the child can reach can be configured by an authorised entity, typically a parent or guardian, to narrow what the child may access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.