ADatP-4778.1 chapter 5 (guidance, but stated as shall for those who canonicalize): before signature generation or verification each data object is converted to a canonical form; text follows S/MIME 4.0 (RFC 8551) section 3.1.1, JSON the JSON Canonicalization Scheme (RFC 8785), XML the XML normalisation of ADatP-4778.2 Annex A (NCIA provides an XSLT for it in NATO's metadata registry) with an XML data object that is a child node carrying all its namespaces, followed by Canonical XML 1.1 for non-XML-Signature mechanisms, and CBOR the core deterministic encoding of RFC 8949. The Signature element itself must not be normalised before verification, and a Signature element without a namespace prefix and with preserved whitespace is recommended.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.