Providers must ensure no security permission is given to a person while in a country listed in the Schedule (China, Iran, North Korea and Russia), and that no security permission can be exercised while its holder is in such a country.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.