The organization must define the boundaries of the records system and state where it applies, then keep that scope available as documented information. Scope is a decision about business activities, functions, sites, legal entities, systems and record types, not a sentence written for the certificate. Anything excluded has to be named and the reason understood, because an exclusion that hides a high-risk activity weakens every later decision about what gets captured and kept.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.