A policy maker sets the eligibility rule, the permitted assurance approaches, the criteria providers must meet and the authentication factors expected. It may stay technology neutral or approve and review specific approaches.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.