The organization should identify the assets an AI system involves or affects and their value: assets of value to the organization, assets of value to individuals and assets of value to society, so that the harm a risk can do is judged against what is at stake for each.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.