A public body must refuse where disclosure would unreasonably disclose a third party's personal information (with exceptions such as consent, public availability, next of kin and officials' job details), protected SARS tax information, third-party trade secrets or harmful commercial information, a contractual duty of confidence, danger to life or safety, police dockets barred in bail proceedings, privileged material unless waived, or third-party research exposed to serious disadvantage. It may refuse for confidential information whose future supply is in the public interest, security of property and systems, law enforcement and prosecution, defence, security and international relations, economic interests and its own commercial information, its own research, deliberative operations (not for records over 20 years old), and requests that are plainly frivolous or vexatious or would unreasonably consume the body's resources. It may refuse to confirm or deny existence only for law enforcement and defence records, stating why. Grounds are applied independently.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.