An access control policy covers the listed subjects, objects and operations of the module, such as operators and the configuration, audit and key objects. The standard's application note for this SFR sets how its operations are to be completed for a QKD module.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.