Personal data the organization sends across a network must be protected by controls meant to make sure it arrives where it should. Usually this means limiting access to the transmission systems to authorized people and following processes, keeping audit logs among them, that deliver the data to the right recipients without it being compromised.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.