Every user access to material that could be used to build keys, such as components or shares, can be traced to one individual through unique IDs (a role or group may be given an ID), and each user can perform only the actions their role authorises.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.