PII processed under a contract is not processed for any purpose separate from the cloud service customer's instructions. 2019 guidance, not confirmed for this edition: instructions may sit in the contract; the processor may choose processing methods within general instructions for technical reasons, applying the ISO/IEC 29100 principles if that involves using PII, and gives the customer what it needs to confirm neither it nor its sub-contractors pursue other purposes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.