Where a consumer's VMs on one host or on several hosts within the same IaaS need to work together, the access policy lets them reach each other for the duration of the collaboration and removes that access when it ends, and the policy covers both the intra-host and the inter-host case because applications may span many hosts.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.