Accounts that carry out privileged actions should not be synchronised from one environment to another (for example between cloud and on-premise).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.