The organization must show continuous enforcement, through technical controls, of every claim it makes in source provenance or VSAs, and must document what each enforced control means: a custom control (such as a required workflow) needs its name, its purpose and where its evidence appears in the provenance; a claim that every consumable revision on main was tested must be enforced by the SCS itself.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.