Authorize the execution of privileged commands and access to security-relevant information over remote access only for compelling operational needs and in a form that leaves assessable evidence, and document the rationale in the system security plan.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.