Governance arrangements decide if and how data relating to or derived from individuals can be made available while protecting privacy and confidentiality, drawing on established managed-access models, proportionate to risk (for example graded access by sensitivity), and taking full account of data protection law, consent terms and research ethics and integrity codes (Principle 2).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.