Meet the Policy's authenticator-type requirements: for memorized secrets, keep a list of commonly used, expected or compromised passwords updated quarterly and on suspected compromise and compare secrets against it quarterly, require a new password on account recovery, allow long passwords and passphrases with spaces and all printable characters, offer automated strength assistance, require at least 8 characters when user-chosen and 6 when CSP-generated, never truncate, allow no hints accessible before authentication, and apply the further verifier rules; and for look-up secrets, out-of-band authenticators, OTP authenticators and single- and multi-factor cryptographic authenticators, meet the respective SP 800-63B authenticator and verifier requirements the Policy reproduces.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.