The processor must carry out processing according to the instructions given by the controller, and the controller must verify that its own instructions and the rules on the matter are observed. A processor that breaches the law or does not follow the controller's lawful instructions is jointly liable and treated as a controller for damages (Art. 42).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.