Users are authenticated, with the number and type of factors and techniques set by an impact assessment of authentication failure and bypass (ECC-1 required MFA for users' access).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.