The controller must give a reasonably accessible, clear privacy notice listing categories of personal data processed, purposes, how to exercise rights, categories shared with third parties and categories of third parties, and must clearly and conspicuously disclose how to opt out if it sells personal data or engages in targeted advertising.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.