Changes are planned, registered with reference numbers, sufficiently described for authorisation, tested in equivalent environments, risk-assessed (high-risk changes approved beforehand by the security officer) and followed by acceptance tests and documentation updates; R1 adds rollback planning, reporting all failures and documenting security impact of every change.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.