A controller that cannot authenticate an access, correction, deletion or portability request with commercially reasonable efforts need not act on it but must tell the consumer it cannot authenticate the request until more information is provided. Opt-out requests need not be authenticated, though a controller may deny one on a good faith, reasonable and documented belief that it is fraudulent, and must then notify the requester that it believes the request is fraudulent and may not comply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.