A controller must respond without undue delay and within 45 days of receiving a request, and may extend once by 45 days where reasonably necessary given the complexity and number of requests if it tells the consumer of the extension and the reason within the first 45 days. If it declines to act it must tell the consumer within 45 days why and how to appeal.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.