Work products should be handled according to the cybersecurity management system, for example kept on a file server that stops them being altered or deleted without authorization.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.