ISO/IEC 27002:2022 control 5.15 applies, with telecommunications guidance: use role-based access control built on a small number of profiles, each with a controlled permission set; since the organization often deals with suppliers whose security capabilities or standards fall short of its own, track all access so it can be changed and withdrawn on time; and let only authorised users reach the communications services allocated to them, for example a given phone number, voicemail box or data service.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.