Network providers must have, and use where appropriate, means to isolate security critical functions from signals not reasonably believed safe. Providers must limit the number of people with security permissions and the extent of those permissions; manage, store and assign credentials securely and revoke them when no longer needed; give each user or system accessing security critical functions an individual credential; make credentials unique and unpredictable; keep records of everyone with access beyond ordinary end use; and limit access to what is strictly necessary.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.