For a model, the device identifier must have been issued by a UDI issuing agency. The production identifier must have been allocated by or for the manufacturer under that agency's rules. A package identifier must also have been issued by an agency, and the device and package identifiers must come from the same agency.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.