The governing body may delegate, yet it stays accountable for what it hands on and responsible for the whole organization. It should delegate in ways that build trust and openness, making sure that: the outcomes expected are negotiated, stated and agreed; the resources needed are provided; authority is in line with responsibility, including freedom to make and carry out plans within the set boundaries; outputs, outcomes and processes are reported at intervals with evidence that actions were reasonable and suitable; and consequences for failing to deliver or to comply can be enforced. Nobody should be held to account for matters outside their authority or for which no expectations were stated or agreed; whoever delegates remains accountable for how the delegate uses the authority given. Delegation should be made formal through assurance processes, and limits on decision-making authority set according to the assessed risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.