Persons acting under the authority of the controller or processor may only process personal data on instruction from the controller, subject to confidentiality and contractual obligations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.