The controller and the holder are each responsible for securing the information in the database, with the scope set by the Data Security Regulations under section 17(b) (physical and logical protection, management procedures and work rules, restrictions on employee access).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.