A provider can stand between the person and the relying party, derive the attribute and disclose only the minimum. Where it verifies, it relies on a record issued by a party with authority over the attribute, and checks that the data was not misissued or altered.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.