The controller must ensure the principles are complied with, adopting the measures necessary and sufficient to apply them, and guarantee that the privacy notice given to the data subject is respected at all times by itself and by third parties with which it has a legal relationship.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.