Internal internet use has rules on authorised and personal use and encrypted connections, awareness on browsing hygiene, trained administrators, protection of name resolution, protection against malicious active content and downloads, and a cookie control policy; R1 adds monitoring of browsing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.