The responsible executive must have real power to shape product investment to reach customer security outcomes; business leaders should run the improvement process through normal business management rather than a technical team having to win executive buy-in.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.