Article 12: rights may be exercised directly or through a legal or voluntary representative; the controller informs data subjects of the means available, which must be easily accessible, and may not refuse a request just because another channel was used; processors may handle requests if the contract says so; the controller bears the burden of proving it responded; parents may exercise rights for children under fourteen; responding is free except as GDPR 12.5 and 15.3 and Article 13.3 and 13.4 allow.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.