When an employee transfers department, provisioning of the new account is performed or approved by management or persons independent of the department, and previously assigned functions are disabled before the employee uses the new role's access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.