Access to applications is granted through attribute-based, role-based or context-based policies, and because tenants' data shares a location where an application flaw or injected code could expose it, data segregation between tenants is designed in from the start. Authorisation is enforced through a centralised, decentralised or hybrid system chosen on the tenants' attributes or roles, and SaaS policy rules are written over application users and hosted VMs against application data, memory, applications and code.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.