A processor must follow the controller's instructions and help it meet its obligations: with appropriate technical and organizational measures for consumer rights requests, with security and breach notification under 30-14-1704, and with the information needed for data protection assessments. Neither party is relieved of its own liability, and a processor that is not limited by or departs from the controller's instructions, or begins to determine purposes and means, is a controller for that processing and can face enforcement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.