The asset owner shall control shared passwords where they cannot be avoided (who holds them, how they are changed) and change any password known to be disclosed or compromised.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.