Service accounts, if used, are managed to prevent their use to gain logical access to applications, databases and operating systems, with the method documented by a named employee and available to auditors and the Board; suggested methods are denying interactive console login, changing passwords at least every 90 days and immediately when a system administrator leaves, and restricting credentials to a few authorized employees.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.