The provider must be locatable, its interfaces accessible, the requester authentication and authorisation known or verifiable, the security policies in place, and the identifiers agreed or resolvable. Each is the parties work and none is specified in detail here.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.