Ensure every purpose conforms to applicable law and rests on a legal basis that is permitted, communicate the purpose to the principal before collection or before first use for a new purpose, in clear language adapted to the circumstances, and explain adequately why sensitive PII has to be processed; some purposes need a legal basis, or authorization from a data protection authority, and processing whose purpose does not conform to the law should not take place.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.