An issuer may include a refreshService (one or more objects, each stating its type) so a holder or verifier can obtain an updated credential when it expires or where no status information is published; issuers are advised not to add it to credentials whose content is not public unless the service is protected.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.