Controllers must limit collection to what is adequate, relevant, and reasonably necessary for disclosed purposes, and avoid secondary uses that are incompatible without further consent.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.