Firewalls sit between the merchant decryption environment and every other network, confining traffic in both directions to CDE addresses and, inside the CDE, to what decryption operations require; all other traffic is denied, explicitly or implicitly.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.