A controller must keep collection adequate, relevant and reasonably necessary for the purposes disclosed to the consumer, and must not process for purposes beyond what is reasonably necessary to and compatible with those disclosed purposes without the consumer's consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.