Through system design and access control it should not be possible for unauthorised personnel to access personal or system-critical data, OWASP giving examples (Table B1, 7.2: unauthorised access to files or data; Table B5, 19.2: access to the owner's private information; Table C1, 1.3 and 3.4: unauthorised physical access to servers).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.