The API that connects users to the cloud server is designed to resist accidental and malicious attempts to bypass access policy, including the layered APIs that organisations and third parties build on top; APIs that do not need memory access are denied it, and policies govern web API authorisation so that authorised SOAP and REST connections receive the access their protocols request while unauthorised ones receive none or partial access.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.