Before a user can reach a sensitive function or resource exposed over the internet, the software authenticates them using industry-standard mechanisms strong enough to protect credentials as Control Objective 5.3 requires, and authentication decisions are made in a protected part of the software.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.