A key shared by two entities or logically separate systems to encrypt account data between them, including the KEK that protects a data-encryption key, is unique to those two and never given to a third; the requirement does not apply beyond the decryption environment.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.