The controller must act on and tell the consumer the outcome within 45 days, extendable once by 45 days with notice and reasons before the first period ends (not running while a suspected fraudulent request cannot be authenticated), give reasons within 45 days if it will not act, not charge for the first request in 12 months (fees or refusal allowed only for excessive, repetitive, infeasible, unfounded, ulterior-purpose or harassing requests, which it must show), and may seek more information if it cannot authenticate the request.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.