Each certificate must cover one product and state: a unique product identifier (GTIN, model, SKU, UPC or similar) with a description; each applicable rule, ban, standard or regulation separately; the certifier's name, address, email and phone; a records custodian (which can be an always-staffed position); the date (month and year) and place of manufacture; the most recent date and place of testing including each third-party lab relied on (or any testing exclusion claimed); and the certifier's attestation.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.