Before committing to create an AI system, the system operator or developer runs a thorough assessment that records the business need or problem to be solved together with the AI security risks involved and the strategy for mitigating them. Where the data custodian sits inside the developer's organisation, that custodian joins the internal discussions that settle the system's requirements and its data needs.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.