3.5: for composite data objects, metadata bound to a parent applies to every child that has no metadata of the same type (Rule 1); metadata bound to a child never flows up to its parents (Rule 2); binding metadata of a different type leaves existing metadata in place (Rule 3); and binding metadata of the same type replaces the existing metadata of that type (Rule 4). Originator and alternative confidentiality labels count as different types. ADatP-4778.1 recommends top-down labelling: the least restrictive label on the root, stricter labels only on the parts that need them.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.