A processor's activities must be governed by a contract that ties it to the controller, obliges it to act only on the controller's instructions and makes it responsible for meeting the Act's security standards.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.