Systems implement security by design to minimise risks (Table B1, threat 5.1: code injection through communication channels, alongside M10).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.