Security assets and privacy assets that the equipment keeps in persistent storage are always held through secure storage mechanisms, unless the target environment, by physical or logical means, already confines access to the stored asset to authorised entities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.