Require users with access to privileged security functions or security-relevant information, such as audit logs, to use non-privileged accounts or roles when performing non-security functions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.