Like a seat belt chime, give timely and repeated warnings when users, administrators or the configuration are in a truly unsafe state, for example deprecated protocols in use or a super administrator without MFA, who might be asked to acknowledge it at each login or lose key features until MFA is on; the design should avoid alert fatigue.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.