Collect only what applicable law permits and what the specified purposes strictly need; never collect indiscriminately; limit both amount and type; consider before collection what is needed; document the types collected and the justification in the information-handling policies; additional PII for other purposes (direct marketing) only with consent where the jurisdiction requires it, with the principal able to choose and clearly told the response is optional.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.