The SCS must provide identity management or other means to identify and authenticate actors; must let organizations specify which actors and roles may perform sensitive actions (such as creating or updating branches or approving changes); and must document how actors are identified for attribution. This may be provided by the source hosting service, by cryptographic signatures (for example gittuf-managed keys) or by extending existing enterprise identity systems. Activity on the SCS should be attributed to authenticated identities.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.