Require the developer to provide design and implementation information for the controls, including security-relevant external interfaces and a high-level design and project plan detailed enough to permit analysis and testing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.