The SCS must let the organization enforce its own technical controls on named references and mark which references are protected (for example main and release branches but not experimental ones, or release tags protected from deletion, through branch and tag rulesets or gittuf policies). It must record the controls enforced on a reference in attestations produced at the time and tied to the revisions; allow organization-specified properties to appear in the source VSA when the matching controls are enforced; allow organizations to give authorised consumers further attestations about their controls; and refuse organization properties that do not begin with ORG_SOURCE_.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.