A set of mandatory pre-defined roles (VIEWER, OPERATOR, ENGINEER, INSTALLER, SECADM, SECAUD, RBACMNT and the like) with their permissions is defined, custom roles are encoded either by specific permissions or by constraints on existing permissions, limits on the number of permissions per role and roles per subject are stated, operational states are considered, and security events are defined for how roles and permissions are engineered.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.