For microservices-based applications the authentication infrastructure also authenticates services, not only users: each workload or service carries a portable, interoperable cryptographic identity with a standard means of retrieving, validating and working with it (the SPIFFE specification is the example given); the identity abstracts away the hosting environment because services migrate between virtual machines and pods; and authentication and authorisation are repeated continuously through a request rather than once at its start, since the risk profile can change as more entities join or behaviour shifts.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.