Each access by non-IT personnel, including the system manufacturer's staff, is recorded with at least the visitor's name, arrival and departure dates and times, the reason for the visit and the name of the IT person who authorized it (the reason and authorizer may be recorded separately, for example in a help desk ticket).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.