Where a requested record might contain a third party's personal, SARS, commercial, confidential or research information, the information officer must take all reasonable steps to inform the third party within 21 days by the fastest reasonable means, describing the record, the requester, the relevant provisions and any public interest override, and that the third party may object or consent within 21 days (in writing if not told orally). Within 30 days after informing every third party the officer must decide, notify the third parties and the requester with reasons and challenge rights, and, if granting, give access only after 30 days unless a challenge is lodged.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.