Criteria for key duties (handling personal or important information, access to key systems) are defined; employees and outsiders performing them are designated as key personnel, and those handling personal information as personal information handlers, with both lists kept current and designations minimised to business need.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.