Subjects can look up who used or received their personal credit information, for what purpose, when and what information (except internal management and repeated outsourcing and other Decree cases); on request they are notified whenever it is used or provided, and they are told they may ask for such notification.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.