Control: everyone under the processor's control who can access PII is bound to confidentiality. Guidance: a confidentiality agreement of whatever form between the processor, its employees and its agents ensures they do not disclose PII for purposes separate from the customer's instructions (A.3.1), and its obligations continue after the relevant contract ends.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.