Agencies should place IDS/IPSs at every gateway between agency networks and any network that the agency does not manage.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.