Chapters 6, 7 and 11: in SOAP (urn:nato:stanag:4778:profile:soap 1:1) the BDO sits in a WS-Security Security header holding only the BindingInformation element, with the actor (SOAP 1.1) or role (SOAP 1.2) attribute set as the profile specifies. In REST (urn:nato:stanag:4778:profile:rest 1:2) the detached BDO travels in an HTTP Binding-Data header whose binding-data-object parameter carries the base64 BDO and whose binding-type parameter must be present, with a null DataReference and a required contentType, and signature digests computed as the profile specifies. In the Web Service Messaging Profile (urn:nato:stanag:4778:profile:wsmp 1:1) an embedded BDO covers the whole message, and each Create, Read, Update or Delete wrapper carries its own detached BDO in its MetadataBinding element.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.