ADatP-4778.1 chapters 2 to 4: rather than lifting a whole document to its most sensitive paragraph, the least restrictive label goes on the root element and stricter labels only on the portions that need them, so an access control decision function can release the rest and redact the stricter nodes; for JSON and other formats granular labels use URI fragment identifiers interpreted per content type; for XML the XPath data model applies, no classification attaches to the XPath root node, and every other node type (element, text, attribute, namespace, comment or processing instruction) is handled at the level of the label associated with it. The NATO Metadata Binding Service offers get (valid label values for a user or recipient), set (create a validated, optionally cryptographic binding) and verify (validate and optionally map a label to another policy) operations. The DCS maturity levels (basic labelling, enhanced labelling, cryptographic protection) all rest on STANAGs 4774 and 4778.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.