Except for Public Entities' awareness materials, the Controller may not use a person's own communication channels, including post and email, for advertising or awareness materials without the recipient's prior consent and a clear mechanism to stop them (Law 25). Consent is required where there is no prior interaction, freely given, with options the recipient can choose, and documented; senders are named, opting out is easy, free and at least as easy as consenting, sending stops on request, and evidence of consent is kept (IR 28).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.