Purposes must be set by the owner's or operator's founding or other documents and match those declared at collection; a change of purpose needs fresh consent. Data must be accurate and updated, its volume matched to the purposes, held in identifiable form only as far as the purposes require, used by staff only within their duties, and not processed beyond the period of the subject's consent; storage ends when the purpose is achieved.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.