Agencies should set predefined limits on the volume of sensitive data users can access and the duration of access, and restrict access when limits are exceeded, through system access controls with logging and monitoring or by requiring re-authorisation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.