Restrict registry access to authenticated users and workloads, enforce role based controls over who can push images, and remove anonymous read where possible. Apply network controls so that only approved nodes can pull from the registry.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.