A controller may refuse a request having regard to national security, public order, an inquiry or investigation under written law, crime prevention and prosecution, other people's rights under written law, technical and operational feasibility, inability to verify identity, or a legal requirement to process the data; it must record its reasons and give those records to the Authority on written request, and may ask for extra information to confirm the requester's identity.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.