Physical and logical access controls enforce separation of duties so that staff working in the stores (the encryption environment) cannot reach any system component of the decryption environment or of any cardholder data environment, while decryption-environment staff remain free to shop in those stores.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.