Devices allowed to connect to the SUC through external networks are grouped into a separate zone or zones; the held IIoT paper calls this a recommendation and reads it as requiring cloud-based functions to sit in zones of their own.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.