On request a controller must confirm whether it processes the consumer's personal data and give the consumer access to that data, unless confirmation or access would reveal a trade secret.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.