A controller must respond without undue delay and within 45 days of receipt, extendable once by 15 days when reasonably necessary if the consumer is told of the extension and the reason within the first 45 days. If it cannot act, it must tell the consumer within 45 days why and how to appeal. It need not act on a request it cannot authenticate but must make a reasonable effort to obtain the information needed to authenticate. It must notify the consumer within 60 days of receipt that it has complied.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.