The actors interact along identifiable PII flows: the principal provides PII to a controller, the controller provides PII to a processor for processing on its behalf, the processor may sub-contract to another processor, the controller or processor discloses PII to a third party, and PII may flow back; each flow is a point at which the safeguarding requirements must be met and roles determined.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.