The tester must demonstrate impact in business terms by safely simulating data exfiltration of test or low sensitivity records, never extracting genuinely sensitive customer data unless explicitly authorised.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.