Internal staff accept the security policy before receiving credentials, acknowledge custody duties, keep credentials under exclusive control, change them per policy, have them disabled on compromise or leaving, face minimal-information login and limited attempts, and are informed of their last access; the reinforcements add stronger factors, multi-factor for remote and privileged access and further controls by level.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.