The processor must process in accordance with the controller's instructions and the contracts and agreements between them, which must specify in particular the scope, subject, purpose, nature and type of personal data and the category of data subject.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.