For password-based authentication the control system shall enforce configurable password strength (minimum length and character variety). RE 1 restricts password generations and lifetimes for human users; RE 2 extends lifetime restrictions to all users, including software processes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.