Sensitivity and policy identifiers are held at composition level so that one composition does not mix data under different access rules. Content with two policies should be split into two compositions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.