A system operator that chooses to use or adapt models or components that are not well documented or secured must be able to justify the choice in writing (for instance, no other supplier existed). In that case developers and system operators put mitigating controls in place and run a risk assessment tied to those components, and the system operator shares that documentation with its end-users in a form they can use.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.