Consistent with the federal zero trust strategy memorandum, the network routes every user access request to every application, on premises or software as a service, through an identity provider the enterprise manages, and users authenticate with at least two factors using phishing-resistant (verifier impersonation-resistant) authenticators meeting authenticator assurance level 3 of the digital identity guidelines.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.