Cloud service customer: its access control policy for the use of network services should specify the requirements for user access to each separate cloud service it uses. Cloud service provider: no additional guidance.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.