A process tells users whether the product is compatible with security updates to dependent components or operating systems, and how to manage the risk of not applying them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.