A B/D knows where its data sits within the provider's infrastructure and has every contract state the governing law and jurisdiction. It recognises that data kept abroad is subject to that place's law and that a provider may be bound by the law of its registered jurisdiction wherever the data sits, so contractual access restrictions cannot override it. It assesses the risk of the arrangement against the nature of the data, analyses in detail how differing legal and regulatory requirements change its procedures (among them how incidents are reported, how activity is logged, how long data is kept and how applications are tested), seeks legal advice on the contract where needed to protect sensitive data from involuntary disclosure, and considers compensating measures such as encryption and data masking for what lies outside its direct control.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.