The organisation reaches agreement on which attributes or roles govern access to applications and databases and what the design must consider, keeping the set large enough for flexibility but small enough that policies stay manageable, and designing attributes and roles with their hierarchy relationships for the different tenants.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.