Controllability is the property that an outside agent is able to intervene in how the AI system functions, achieved by dependable mechanisms through which control can be taken over. The organisation determines which agents can control which components: the service provider or product vendor, the provider of a constituent AI, the user, or a body holding regulatory authority. Sub-clause 10.4 of ISO/IEC TR 24028 gives more.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.