Compiler, interpreter and build tools with features that improve executable security are used, with the features to use and their configuration determined, implemented and used as approved. The organisation may capture the versions and features of these tools as part of its provenance tracking.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.