A controller must provide, and describe in its notice, one or more secure and reliable means to submit rights requests that reflect how consumers normally interact with it and allow authentication, and must not require a consumer to create a new account to exercise rights (an existing account may be required).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.