Where personal data is sold or shared, the controller should bind recipients contractually to use limitations, security obligations, and downstream consumer rights honoring. This supports the TDPSA accountability and DPIA expectations.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.