The controller must enable the data subject to object to processing, withdraw prior consent, and access and update their data, providing the means it considers appropriate to let the data subject do so securely.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.