Agencies must hash passwords and other authentication secrets before they are stored, using a cryptographic protocol and algorithm that is approved; Chapter 17 (Cryptography) applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.