For systems processing personally identifiable information, apply the processing rules of all applicable laws and guidance to the PII data elements, monitor for permitted processing at the external interfaces and key internal boundaries, document each processing exception and review and remove exceptions no longer supported.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.