Where a controller relies on the Act's limitations (legal compliance, investigations, claims, requested products, safety, security and fraud, research, internal operations), processing must be reasonably necessary and proportionate, adequate, relevant and limited to that purpose and protected by reasonable safeguards, and the controller bears the burden of showing the exemption applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.