An authorised user accessing CJI from an authorised mobile device uses advanced authentication unless the access is indirect as the IA family defines it, in which case advanced authentication is not required.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.