Measures are implemented to define and control user roles and access privileges on the principle of least access privilege (Tables B3 and C2, 15.1: an owner, operator or maintenance engineer tricked into loading malware or enabling an attack).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.