The controller or holder gives the DPO the conditions and resources needed and involves the DPO properly in every privacy matter; failure can lead to an order to cease the violation (23KE(d)).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.