Decide in advance who has authority to cut communications or stop systems to contain damage, and organise the factors to weigh (timing and duration, business impact by service scope, alternative means and routes); where containment raises fears of recurrence or secondary harm from leaks, take preventive measures, deciding whether containment or evidence preservation takes priority according to the situation and policy, and use external experts where needed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.