A controller must not process personal data for a material new purpose that is neither reasonably necessary to nor compatible with the original purposes unless the consumer consents.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.