Controllers respond without undue delay and within 45 days, extendable once by 45 days with notice and reasons in the first period; if declining, they give reasons and appeal instructions within 45 days. Responses are free up to twice a year, with a reasonable fee or refusal allowed for manifestly unfounded, excessive or repetitive requests (the controller bears the burden). Requests that cannot be authenticated with commercially reasonable effort need not be actioned, and more information may be sought.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.