Where permitted information sits in a file with other information, the provider may pass the excess only if procedures prevent any use of it; until regulations set them, the requesting body sets written procedures and provides them to the provider on request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.