Dual control applies to enabling manual or non-routine key-encryption functions, to placing the device in a state that inputs or outputs clear-text components, and to all access to key-loading devices.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.