The NBFC-AA must not request or store customer credentials (passwords, PINs, private keys) that could authenticate the customer to providers; its access to customer information rests only on consent-based authorisation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.