The controller must respond without undue delay and within 45 days, extendable once by 45 days on notice with reasons; give reasons and appeal instructions within 45 days if it declines; provide responses free up to twice a year (charging or refusing only manifestly unfounded, infeasible, excessive or repetitive requests, which it must prove); and may ask for more information where it cannot authenticate with commercially reasonable effort.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.