Where a CA or KDH submits a certificate-signing request, or asks for a status change such as revocation, suspension or replacement, validation establishes that the submitter is who it says it is, is authorised to make the request for the originating entity, holds a genuine business relationship with the issuer that fits the certificate, and that the request reached the RA by a secure route.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.