A PII controller decides the purpose of PII processing (why) and its means (how); there can be more than one for the same PII; the controller is responsible for ensuring that the processing by processors and third parties on its behalf meets the privacy safeguarding requirements, and for informing principals and the other actors.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.