Controllers must bind processors with contracts addressing scope, security, subprocessing, audit rights, and breach notification, and must monitor compliance throughout the engagement.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.