Every data governance policy statement must (a) carry an authoritative legal entity identifier naming the organization that issued the policy, (b) with that identifier following ISO 8000-116; (c) be identified by its own unique identifier following ISO 8000-115; and (d) point to a computer-processable data specification, namely the one a data set has to meet under the policy (ISO 10303-242, ISO 15926-2 and ISO/TS 29002-10 are given as examples of such specifications). Items a) to d) are the whole clause: clause 6, held in the ISO/PRF 8000-51 proof, makes conformance turn on exactly those four. Clause 4 gives the reasoning: an organization has a complete governance regime once every item of its data falls under at least one policy statement; it can govern data effectively only if each statement can be told apart by a unique identifier; it proves conformance by collecting data sets as evidence, each valid only if it meets every applicable data specification; and requirements coming from supply chain partners or regulators travel between organizations and applications only when they are computer processable with semantics everyone reads the same way (the standard's example is software robots testing every data process for GDPR compliance).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.