A controller must offer at least two secure and reliable methods for rights requests, reflecting how consumers interact with it, secure communication and authentication; must provide a request mechanism on its website if it has one (an online-only business with a direct relationship may offer just an email address); and must not require a new account, although it may require use of an existing one.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.