Require users to re-authenticate when roles, authenticators or credentials change, when the security category of a system changes, when privileged functions are executed, and every 12 hours.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.