A controller must provide a reasonably accessible, clear and meaningful privacy notice listing the categories of personal information processed, purposes, how to exercise and appeal rights, categories sold and categories of third-party buyers; if it sells personal information or runs targeted advertising it must clearly and conspicuously disclose that and how to opt out.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.