Authenticity asks whether the identity of a user, a system or a message can be proven. A measure relates authenticated entities or messages to the entities or messages in scope. Authenticity is a property of a claim and its proof. It covers users, services and messages, and the strength of the proof matters. A password and a hardware key both authenticate, and they do not give the same assurance. The measure should say which mechanisms are in scope and what proportion of the population uses them, and it should include the negative case: a forged claim that must be rejected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.