Merchant logical access to POI devices, where needed at all, is restricted so the merchant cannot view or change device configuration, sees only transaction-related data, cannot reach keys, clear-text PAN or SAD, cannot enable disabled interfaces and uses no vendor default accounts; where a regional legal obligation requires full PAN on receipts, that access is allowed only with the obligation documented and the P2PE application handling it as 2A-3.1.2 and 3A-1.3 require.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.