Requirement 0060 (Part Three: Information, section 9.2 Classifications and Caveats; applies to All entities; dated 31 October 2024; retained from Release 2025): The security classification is set at the lowest reasonable level. Over-classification restricts access unnecessarily; the classification reflects the assessed damage and no more.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.