Agencies should grant data access on a need-to-know basis, review access rights regularly, ensure users reach only data they are entitled to, and confirm before use that the task falls within the permitted purposes.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.