No step in an authentication process requires a cognitive function test unless it offers an alternative method without one or a mechanism to help complete it; the object recognition and personal content exceptions do not apply. (new in 2.2)
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.