The controller sets users' access permissions to the database and systems by role, only to the extent the role needs, and keeps an up-to-date list of roles, permissions and the users holding them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.