The asset owner shall use mutual authentication between components and services where the risk requires it, so that a component verifies what it talks to.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.