Consent may be withdrawn at any time and the controller must make withdrawal as easy as giving it. Regulations may create a right to receive data in a structured, machine-readable format and to have it transmitted to another controller, with conditions on costs and timing.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.