Cloud service customer: make sure it is possible to limit access to its information in the cloud service as its access control policy requires, and that those limits are actually applied, covering access to the services themselves, to their functions, and to the customer data the service holds. Cloud service provider: provide access controls that let the customer restrict access to its cloud services, their functions and the customer data held in them. Other information: other areas of the cloud environment also need access control, and functions such as hypervisor management and administrative consoles may need additional controls.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.