The policy should set expectations for communication: when the vendor will acknowledge a report, how often it will update the reporter and what the reporter can expect at each stage, so that both sides know the cadence.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.