The organisation decides, product by product, whether the solution also governs libraries, scripts, macros, browser plug-ins and extensions, configuration files and registry entries, and at what granularity (whole classes of scripts or individual scripts), because products differ widely in what they can permit or block.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.