Administrator and other special privileges are granted to the minimum number of people through formal request and approval, and special-purpose accounts and privileges are identified, listed separately and controlled.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.