Decryption-environment systems are dedicated to decryption and key management or to supporting them, run only the services, protocols and daemons they need and have unrelated functions removed; supporting functions such as logging may be placed in the wider CDE, but any that are placed inside the decryption environment serve only it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.