Processing without explicit consent is allowed where expressly provided by law, necessary to protect life or physical integrity, necessary for contract performance, necessary for legal obligation, data made public by subject, necessary for establishment of right, or legitimate interests of controller not overriding subject rights.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.