The asset owner shall authorize access to IACS functions and data based on the user's role, enforced by the components (3-3 SR 2.1 at the system level).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.