The asset owner shall ensure software services and processes authenticate to the IACS with their own credentials, not shared human credentials.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.