Every authentication mechanism required by AUM-1, on any of the three interface types, lets the authenticator be changed, except where conflicting security goals make change impossible (an immutable device identity, for example).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.