Every change to the application follows change control with documentation of impact, documented approval by authorised parties, functionality testing that the change does not weaken the device's security, and back-out, rollback or de-installation procedures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.