Segregation of duties between roles, enforced by automated or manual means, keeps any one person from controlling an end-to-end process or compromising the Host System: no user audits their own activity and administrators use their operator-level account for non-administrative work.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.