All information exchanges and services with other systems need prior authorisation (flows forbidden unless expressly allowed), and each interconnection documents interface characteristics, security and data protection requirements and the nature of the information; R1 adds coordination mechanisms where identification and authorisation sit in different security domains.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.