Where a decision significantly affecting a subject is based solely on automated processing, the controller must notify the subject in writing as soon as practicable, covering the processing and its purpose, transparency measures, storage, likely effects and the right to object to marketing use, and reconsider the decision on request; exceptions are contract necessity, legal authorisation and explicit consent, though the regulations let the subject refuse use of their data in such decisions.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.