A processor must follow the controller's instructions and assist it, by appropriate technical and organisational measures so far as reasonably practicable, in answering consumer rights requests and by providing information needed for data protection assessments; a processor that goes beyond instructions for a processing activity may become a controller for it.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.