Deny network communications traffic by default and allow network communications traffic by exception (deny all, permit by exception).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.