Agencies should protect sensitive data directly by one of: hashing with a secret salt so values cannot be reversed (suited where originals need not be recovered, such as analytics identifiers); field-level encryption with decryption limited to authorised users (suited where actual values are often needed, such as service delivery); or tokenisation, with the token-to-value mapping kept securely and separate from the tokenised data.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.