A controller must not process a consumer's sensitive data without the consumer's consent, and must process a known child's sensitive data in accordance with COPPA.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.