The TOE identifies users, enforces access control, performs quantum key distribution, authenticates the classical channel, audits cryptographic functions, self-tests, limits emanations, sanitises on end of life and limits user sessions; the environment supplies trustworthy users and personnel, review and availability of audit records and a secure operational environment, with a rationale mapping each objective to the threats, policies and assumptions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.