Personal data may be disclosed (cesion) only to fulfil purposes directly related to the legitimate interest of the discloser and the recipient, with the prior consent of at least one of the data subjects (subject to the Article 27 exceptions).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.