The equipment governs which entities can reach its security assets and its financial assets through access control mechanisms. An asset may be left outside access control only where making it publicly reachable is what the equipment is for, where the environment it is designed for already confines access, by physical or logical means, to authorised entities, or where the law does not permit access control for it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.