Before issuing credentials, external users are reliably registered (directly or via a qualified trust service or recognised identity provider); they acknowledge custody duties; credentials are under their exclusive control, changed per policy, disabled on suspected compromise or end of relationship; login reveals minimal information and does not state why it failed; attempts are limited with account lockout; stronger factors (password, one-time codes, certificates, qualified devices) and further reinforcements apply at higher levels as CCN-STIC guides specify.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.