Datasets come with anything from no descriptive information to full documentation, and the organization can judge a dataset's impact best when the information is complete; it should take this into account in deciding what the assessment records. In documenting the datasets used, it should consider its data quality, data governance, security and privacy processes and cover: whether the information about the data is available for human review (machine-readable form is fine if a reviewer can still examine it); how and from where the data was obtained, and whether collection met legal obligations, ethical principles and internal policies; the amount of data relative to the system's needs; the dataset's provenance (creators, stewards, users, processing applied, storage locations); known or foreseeable risks of unwanted bias; the geographic areas covered; data quality processes; access control and protection; the time span of the data (first and last dates of additions); review of the data by relevant interested parties, including whether diverse reviews took place; and whether the data is real, synthetic or partly synthetic. Unsuitable training, validation or test data can produce wrong outputs that harm people, and discrimination present in training data can be carried forward or amplified by the model.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.