Application access rights are differentiated by user duties; idle sessions are cut and concurrent sessions of one user limited; administrator applications (admin web pages, consoles) are closed to unauthorised users; consistent masking standards apply to personal and important information; and applications minimise unnecessary exposure through viewing, display, printing and downloading.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.