Privileged access is managed. The guide expects privileged access to be defined per infrastructure, network and application, privileged users identified, admin accounts kept off daily tasks, internet and email, default accounts disabled, hardened admin workstations and continuous monitoring of privileged activity.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.