Any whitelisting in the decryption environment that sends data to the encryption environment permits clear-text output only for cards outside the PCI payment brands, is signed before it is installed and authenticated by the HSM, is reviewed to confirm it does nothing more, is approved by authorised staff, and has every installation and update signed, authenticated and taken through change control with a description, justification, approver and review before release.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.