Systems sit on a spectrum of risk set by the severity of the impact of failure or unexpected behaviour. The organisation assesses the level using the aspects listed: the kind of action space (recommendations, or direct action in an environment), whether external supervision exists and whether it is automated or manual, how ethically sensitive the task or domain is, the transparency of decisions and processing steps, and the degree of automation. A system that only recommends in a domain without ethical weight can be low risk; one whose actions directly affect human lives, unsupervised and opaque, can be high risk. Domain-specific law, policy and standards can require more than this impact analysis.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.