Where confidentiality is not required and only authentication and integrity are needed, integrity-only cipher suites (RFC 9150 for TLSv1.3, NULL-encryption suites in TLSv1.2) may be used as the referencing standard or security policy allows, so that protection can be applied on constrained links; their use is a declared choice, not a default.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.