A controller must establish, and describe in its notice, secure and reliable means to submit rights requests that reflect how consumers usually interact with it, secure communication and identity verification, and must not require a new account, though it may require use of an existing one.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.