The processor must avoid anything that would disclose personal data or processing results except where the law authorises it, and must protect and secure the processing, the electronic media and devices used, and the personal data on them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.