A third party is a privacy stakeholder other than the principal, controller or processor that receives PII from a controller or processor and becomes a controller in its own right for that PII, using it for its own purposes under the applicable law.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.