Because operators, application support, infrastructure support and data centre teams, in house or at the provider and its subcontractors, may all handle information assets, authentication and authorisation are defined clearly: who may access the data, what rights they hold and under what conditions. A default-deny policy is maintained and least privilege followed for staff reaching cloud data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.