Because provider-side policy configuration forces policies to be stored and evaluated at the provider, exposing the sensitive data needed to evaluate them, methods such as federated authorisation are considered: a middleware layer that shifts policy management to the consumer and enforces policies on the SaaS application without the provider seeing the sensitive attributes, centralising consumer policy management and lowering the trust required in the provider.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.