Disclosure of personal data to third parties requires consent or other lawful basis matching the original collection purpose.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.