Any person acting under the authority of the controller or the processor, and the processor itself, who accesses personal data may process it only on the controller's instructions, except under legal obligations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.