Every access request, from a service, user or device, arrives with a claimed identity that is verified with robust, phishing-resistant multi-factor authentication; identity alone is not enough, so the decision also uses contextual information chosen on a risk basis from five areas: the user's attributes (role, assignments, cross-verified status), trust in the device from its health and risk posture, telemetry such as whether it is managed and whether it is compromised, real-time context (date, time, geolocation), the service or data requested, and the security of the environment hosting it. Contextual information comes from the native platform and from third-party platforms, is available in real time so access is not slowed, is prioritised by value, and is consistent with the risk of each request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.