Resources are protected so only entities with sufficient rights can use them, rights are set by the resource owner under the policy, and access to operating system components and configuration is controlled; R1 gives each user individually maintained privilege attributes restricting read, write, modify and delete; R2 controls access to devices.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.