Personal data may not be processed without the explicit consent of the data subject, unless one of the exceptions in Art 5(2) applies. Consent must be informed, specific to the processing, and freely given.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.