Where a controller cannot authenticate a request to exercise a right using commercially reasonable efforts, it need not act but must tell the consumer it cannot authenticate the request until the consumer provides the additional information reasonably necessary. A controller need not authenticate an opt-out request, but may deny one on a good faith, reasonable and documented belief that it is fraudulent, in which case it must notify the requester that it believes the request fraudulent, why, and that it will not comply.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.