A controller whose database is held by a holder refers the requester to the holder, giving its address, and instructs the holder in writing to allow review; a holder approached first tells the requester whether it holds information about them and gives the controller's name and address.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.