PII is encrypted before it is sent over public data-transmission networks. 2019 guidance, not confirmed for this edition: some header or traffic data may have to stay exposed for delivery, and roles may be shared among providers.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.