Wherever the ISAE has the service auditor inquire of, request representations from or communicate with the service organisation, the auditor decides which people in its management or governance to deal with, choosing those with the responsibilities and knowledge the matter calls for.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.