Access to sensitive data in ICT systems should be granted only to authorised users and privileged access only where necessary, reviewed regularly and removed promptly on role change, limited to the data needed for a stated purpose, and privileged accounts or data roles limited to the systems, platforms and datasets needed for the users' functions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.