For almost all protocols the main recommendation is a hybrid approach in which a well-established algorithm and a post-quantum algorithm are used together within one protocol, so that an attacker must break both; this covers the relative immaturity of the new algorithms and implementation mistakes and can keep a deployment compliant where PQC is not yet approved, at a modest overhead. The organisation checks that products described as hybrid really combine both algorithms at once rather than offering a choice between them, and does not confuse this with the usual combination of asymmetric and symmetric encryption. Configurations that let a client pick either algorithm (optional post-quantum) invite downgrade attacks and interception for later decryption, so internal systems use the combined form, and policies set when and how externally facing systems may use the optional form.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.