The CSP issues the credential, or the means to generate it, to the entity or its authorized representative through a formalized and documented process; where it is not delivered in person the delivery address is checked as existing and legitimately associated with the entity, and at LoA4 delivery is over a secure channel with a signed receipt.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.