Define the criteria and subject/resource attributes the policy engine uses to grant or deny access for the candidate resource.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.