A processor must act only on the controller's written instructions, bind its personnel (employees, consultants, agents, affiliates and contractors) to confidentiality, allow controller compliance audits and inspections, and on instruction erase or return data at the end of the service. A processor that departs from instructions or sets its own purposes and means is treated as a controller; the same duties apply to sub-processors, and the processor answers to the controller for a sub-processor's failures.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.