The solution is first run in audit mode, which logs execution of items not on the whitelist without stopping them, so the organisation can evaluate and tune it; it is then switched to enforcement mode, choosing between whitelist enforcement (only listed items run), user prompting and blacklist enforcement, and using granular settings where the product allows different modes for different entity types, for example auditing registry changes while blocking operating system file changes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.