A processor processes only on the controller's instructions and for no other purpose, implements the required security measures, keeps the data confidential, deletes them when the relationship ends or on instruction (absent a legal retention duty) and transfers them only as the controller determines, for subcontracting or to a competent authority; the relationship must be established by contract or another instrument that proves its existence, scope and content and agrees with the privacy notice. A processor that uses data for other purposes or transfers without instructions becomes a controller. Subcontracting requires the controller's authorisation (given in the contract or obtained beforehand), is formalised by contract, binds the subcontractor to the processor's obligations and must be proven by the processor.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.